MagSolutionsAIWhat breaks when machines write the imports
Analysis of the supply chain risk in AI-generated code — hallucinated packages, claimed slopsquats, and how to verify a dependency before it reaches your build server. Evidence and reproducible checks, not vendor opinion.
Field report: 14898 real pull requests scanned, 6.4% flagged, 46 of our own mistakes fixed in public
14898 real public pull requests scanned and 12740 dependencies resolved against the live registries; the check flagged something in 6.4% of them. 46 corrections to our own detector, each pinned by a test. Measured, not estimated, and re-checked weekly.
One npm account, 14 packages, four scopes: a dependency-confusion campaign built to look like someone's internal SDK
Between 23 and 25 October 2026, the npm account "wiseke" published 14 packages across four scopes, including @greenlake/auth and @sxm-web/client-sdk-core. GitHub reviewed all of them as malware the same week, days after the first one went live.
Field report: 12656 real pull requests scanned, 9.6% flagged, 46 of our own mistakes fixed in public
12656 real public pull requests scanned and 11266 dependencies resolved against the live registries; the check flagged something in 9.6% of them. 46 corrections to our own detector, each pinned by a test. Measured, not estimated, and re-checked weekly.
items-validator and item-validator: three weeks old and six years dormant, flagged as malware the same morning
On 19 October 2026, GitHub reviewed two similarly named npm packages as malware: items-validator, first published three weeks earlier, and item-validator, untouched since February 2020. Only one of them would have looked new to a dependency-age check.
How to read a package's install scripts before npm runs them
npm executes preinstall, install and postinstall scripts automatically — before you've looked at a single line of the package. The registry publishes those scripts in its own metadata, so you can read them without installing anything.
Field report: 9917 real pull requests scanned, 7.9% flagged, 46 of our own mistakes fixed in public
9917 real public pull requests scanned and 8900 dependencies resolved against the live registries; the check flagged something in 7.9% of them. 46 corrections to our own detector, each pinned by a test. Measured, not estimated, and re-checked weekly.
Six Angular typosquats, one postinstall hook, published the same morning
On 5 October 2026, GitHub reviewed six npm packages impersonating @angular/core and @angular/cli — all claiming Angular's current version number, five of them sharing one postinstall command. All six are gone; the real @angular/core took 7.3 million downloads the same week.
Field report: 6949 real pull requests scanned, 6.1% flagged, 46 of our own mistakes fixed in public
6949 real public pull requests scanned and 6619 dependencies resolved against the live registries; the check flagged something in 6.1% of them. 46 corrections to our own detector, each pinned by a test. Measured, not estimated, and re-checked weekly.
pull_request_target in the wild: 60 public workflows, 6 exploitable, and the fixes that actually work
We checked 60 public GitHub Actions workflows that use pull_request_target. Most that look dangerous are not. One that explicitly declared its risk was, and our own rule missed it until today.
One dropper, five PyPI names — one of them a typosquat of a real Claude Code tool
On 27 September 2026, GitHub reviewed five PyPI malware advisories sharing one payload and one blockchain command server. One of the five, claudedashbord, is a one-letter-off copy of a real, published Claude Code dashboard tool.
Field report: 3734 real pull requests scanned, 0 hallucinated packages confirmed
3734 real public pull requests scanned, 3500 dependencies resolved against the live registries, 0 hallucinated packages confirmed. Measured, not estimated, and re-checked weekly.
Field report: 1496 real pull requests scanned, 0 hallucinated packages confirmed
1496 real public pull requests scanned, 1728 dependencies resolved against the live registries, 0 hallucinated packages confirmed. Corrected on 21 September 2026 — this article first said 7. Measured, not estimated, and re-checked weekly.
A package labelled itself "SECURITY RESEARCH." GitHub flagged it as malware anyway.
On 20 September 2026 someone published starbucks-sdk to npm, described it in the registry as a dependency-confusion proof of concept, and shipped a preinstall script that phones home. The advisory that followed didn't care about the label.
Withdrawn: the field report of 18 September 2026 was built from test data
This report was published with figures from our own test suite, not from a measurement. It is withdrawn; the real figures are published live.
langgrap, openaii, transfomers, ollamaa — one typo each, one PyPI campaign
On 11 September 2026, GitHub reviewed four PyPI malware advisories in one batch, each a single-character typosquat of langgraph, openai, transformers or ollama. The payload includes code written to discourage analysis by AI coding agents.
We measured how late a malware advisory arrives. Sometimes 95 days.
Across the 100 most recent npm malware advisories, 30% arrived more than a day after the package was published. 95% of those packages were under 30 days old when the advisory landed.
Thirteen npm packages, 48 seconds, one fake wallet SDK
On 7 September 2026, GitHub's Advisory Database flagged 13 npm packages named after Coinbase's wallet infrastructure as malware. Registry timestamps show all 13 were published within 48 seconds of each other.
The malicious package that never showed up in anyone's requirements.txt
Two PyPI packages published this week show why checking your direct dependencies is not enough. The credential-stealing code was one dependency away, in a package nobody typed into a requirements file on purpose.
What is slopsquatting, and why your scanner cannot see it
Attackers no longer wait for you to mistype a package name. They register the names your AI assistant invents. Here is how the attack works and why CVE-based tooling is blind to it by design.
The package that never existed and got 30,000 downloads
In 2024 a researcher registered huggingface-cli, a name AI models kept recommending but which was never real. Three months later it had over 30,000 downloads — including from a major tech company's public documentation.
How to check whether a package actually exists before you install it
A practical guide to verifying Python and npm dependencies against the live registries — the exact commands, what the responses mean, and the check most people forget after the first one passes.