How AI coding tools could amplify software supply-chain attacks

What happened

AI coding tools are changing how developers obtain and use software. A vulnerability uncovered by Bloom Security demonstrates how weaknesses in software publishing infrastructure can intersect with these automated workflows.

Contributed How AI coding tools could amplify software supply-chain attack (an attack that reaches a target through software it depends on)s Bloom Security’s SlugFest research found npm’s Trusted Publishing tied trust to a repository’s name rather than its permanent ID. GitHub shipped a fix on 2 October, almost four months after the report.

October 13, 2026 - 10:00 am AI coding tools are changing how developers obtain and use software. The research, named SlugFest, identified more than 1,500 npm packages vulnerable to a publishing attack involving GitHub repository addresses.

But the growing volume of automated package installations is creating new challenges for enterprise security teams. Together, the packages had accumulated more than 10 million downloads. Bloom also measured the scale of AI-driven software installation across large enterprises.