How AI Coding Tools Could Amplify Software Supply-Chain Attacks
Bloom Security’s SlugFest research revealed a vulnerability in npm's Trusted Publishing, where trust was tied to a repository's name rather than its permanent ID. GitHub addressed this issue on October 2, 2026, nearly four months after the report.
AI Coding Tools and Software Dependencies
AI coding tools are revolutionizing how developers source and utilize software. However, the surge in automated package installations presents new challenges for enterprise security teams. SlugFest highlights how weaknesses in software publishing infrastructure can intersect with these automated workflows, potentially exposing organizations to malicious code without the need for attackers to steal credentials.
Research Findings:
- Over 1,500 npm packages were vulnerable to a publishing attack utilizing GitHub repository addresses.
- These packages had amassed more than 10 million downloads collectively.
- On average, a typical endpoint receives approximately 70 AI-driven package installations each month, while developer machines can approach 350.
Enterprise Exposure:
Bloom's study of AI agents across numerous organizations revealed:
- Each agent installs between 0.3 and 1.2 packages per day.
- Developer machines experience higher activity, with 2-3 direct package installations daily.
- Endpoints typically run 3 AI agents, while developer machines can run 5 or more.
This increased activity expands the opportunities for untrusted code to enter an environment, as packages may execute installation scripts without human review.
The Vulnerability:
The SlugFest vulnerability stemmed from npm Trusted Publishing, designed to enhance security by replacing long-lived publishing tokens with short-lived credentials. However, npm initially established trust using a GitHub repository's human-readable address, not its permanent identifier. This oversight creates risks when repositories are renamed, transferred, or deleted, as old addresses can be claimed by others.
Prevention and Mitigation:
Bloom successfully caught and blocked an AI agent attempting to install a vulnerable package, demonstrating the practical intersection between automated workflows and supply-chain exposure. To mitigate such risks, organizations should:
- Implement robust security measures for software publishing infrastructure.
- Employ more permanent and unique identifiers for repositories.
- Conduct thorough reviews of AI-driven package installations.