AI code suggestions sabotage software supply chain
· Source: theregister.com
In short
AI-powered code generation tools are introducing risks to the software supply chain by hallucinating non-existent package names, which malicious actors exploit by creating fake packages. Researchers found that 5.2% of commercial AI model suggestions and 21.7% from open-source models include fake packages. This 'slopsquatting' tactic can lead to malware execution when developers unknowingly install these packages.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 15, 2025: Agentic AI Drives Autonomous, Resilient Supply Chains Amid New Security Threats
Tags: AI, security, supply-chain, malware, coding