MagSolutionsAIWhat breaks when machines write the imports
Analysis of the supply chain risk in AI-generated code — hallucinated packages, claimed slopsquats, and how to verify a dependency before it reaches your build server. Evidence and reproducible checks, not vendor opinion.
We measured how late a malware advisory arrives. Sometimes 95 days.
Across the 100 most recent npm malware advisories, 30% arrived more than a day after the package was published. 95% of those packages were under 30 days old when the advisory landed.
Thirteen npm packages, 48 seconds, one fake wallet SDK
On 7 September 2026, GitHub's Advisory Database flagged 13 npm packages named after Coinbase's wallet infrastructure as malware. Registry timestamps show all 13 were published within 48 seconds of each other.
The malicious package that never showed up in anyone's requirements.txt
Two PyPI packages published this week show why checking your direct dependencies is not enough. The credential-stealing code was one dependency away, in a package nobody typed into a requirements file on purpose.
What is slopsquatting, and why your scanner cannot see it
Attackers no longer wait for you to mistype a package name. They register the names your AI assistant invents. Here is how the attack works and why CVE-based tooling is blind to it by design.
The package that never existed and got 30,000 downloads
In 2024 a researcher registered huggingface-cli, a name AI models kept recommending but which was never real. Three months later it had over 30,000 downloads — including from a major tech company's public documentation.
How to check whether a package actually exists before you install it
A practical guide to verifying Python and npm dependencies against the live registries — the exact commands, what the responses mean, and the check most people forget after the first one passes.