How AI coding tools could amplify software supply-chain attacks
· Source: thenextweb.com
In short
Research from Bloom Security, dubbed SlugFest, identified more than 1,500 npm packages exposed to a publishing attack that exploits how npm Trusted Publishing binds trust to a GitHub repository's human-readable slug rather than its immutable identifier. The flaw could let attackers publish malicious versions under legitimate package names, which AI agents may then install automatically — Bloom measured roughly 70 packages installed by AI agents per endpoint each month. npm has since remediated the issue after more than 120 days, and Bloom urges enterprises to audit agent-installed software and enforce a supply-chain firewall.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 42, 2026: Planning AI reaches a quantified milestone as Cencora reports 10% forecast improvement
Tags: supply chain, cybersecurity, automation, npm, AI agents, dependencies