Supply-chain attacks take aim at your AI coding agents
· Source: csoonline.com
In short
Attackers are adapting supply-chain techniques to target AI coding agents by crafting malicious packages with persuasive descriptions and legitimate functionality on registries like NPM and PyPI. The PromptMink campaign attributed to North Korea's Famous Chollima APT group uses LLM optimization and knowledge injection to make malicious dependencies more likely to be discovered and chosen by AI agents. Additionally, 'slopsquatting' exploits hallucinated package names from LLMs, creating new security risks in the software development supply chain.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 19, 2026: AI-Driven Platforms Boost Resiliency and Efficiency Across Global Supply Chains
Tags: supply-chain, AI agents, cybersecurity, software development, malware, vibe coding