MagSolutionsAI Blog https://magsolutionsai.com/blog/ Analysis of AI-generated code supply chain risk: slopsquatting, hallucinated dependencies, and how to verify what your assistant just suggested. en Wed, 09 Sep 2026 20:44:03 +0000 We measured how late a malware advisory arrives. Sometimes 95 days. https://magsolutionsai.com/blog/advisory-window.html https://magsolutionsai.com/blog/advisory-window.html Wed, 09 Sep 2026 09:00:00 +0000 Across the 100 most recent npm malware advisories, 30% arrived more than a day after the package was published. 95% of those packages were under 30 days old when the advisory landed. securitysupply chainnpmmeasurement Thirteen npm packages, 48 seconds, one fake wallet SDK https://magsolutionsai.com/blog/coinbase-wallet-npm-cluster.html https://magsolutionsai.com/blog/coinbase-wallet-npm-cluster.html Mon, 07 Sep 2026 09:00:00 +0000 On 7 September 2026, GitHub's Advisory Database flagged 13 npm packages named after Coinbase's wallet infrastructure as malware. Registry timestamps show all 13 were published within 48 seconds of each other. supply chainnpmcase studymalware The malicious package that never showed up in anyone's requirements.txt https://magsolutionsai.com/blog/transitive-dependency-malware.html https://magsolutionsai.com/blog/transitive-dependency-malware.html Thu, 03 Sep 2026 09:00:00 +0000 Two PyPI packages published this week show why checking your direct dependencies is not enough. The credential-stealing code was one dependency away, in a package nobody typed into a requirements file on purpose. supply chainPyPIcase studytransitive dependencies What is slopsquatting, and why your scanner cannot see it https://magsolutionsai.com/blog/what-is-slopsquatting.html https://magsolutionsai.com/blog/what-is-slopsquatting.html Thu, 03 Sep 2026 09:00:00 +0000 Attackers no longer wait for you to mistype a package name. They register the names your AI assistant invents. Here is how the attack works and why CVE-based tooling is blind to it by design. slopsquattingsupply chainAI security The package that never existed and got 30,000 downloads https://magsolutionsai.com/blog/huggingface-cli-case.html https://magsolutionsai.com/blog/huggingface-cli-case.html Wed, 02 Sep 2026 09:00:00 +0000 In 2024 a researcher registered huggingface-cli, a name AI models kept recommending but which was never real. Three months later it had over 30,000 downloads — including from a major tech company's public documentation. slopsquattingcase studysupply chain How to check whether a package actually exists before you install it https://magsolutionsai.com/blog/verify-a-package-exists.html https://magsolutionsai.com/blog/verify-a-package-exists.html Tue, 01 Sep 2026 09:00:00 +0000 A practical guide to verifying Python and npm dependencies against the live registries — the exact commands, what the responses mean, and the check most people forget after the first one passes. how-toPyPInpmsupply chain