#dependency-scanning
Tagged “dependency-scanning”
2 articlesSupply-chain security
HalluSquatting: the dependency your agent invented, and the attacker who registered it first
Researchers from Tel Aviv University, the Technion, and Intuit describe a supply-chain pattern, HalluSquatting, that turns an AI coding agent's tendency to hallucinate package and repository names into a delivery channel for remote code execution and botnet payloads. The novelty is in the delivery, not the malware.
Jul 13, 2026 · Tomás VegaSecurity & supply chainThe 'OSS ingredients are basically safe' assumption just got a 52,000-package counter-example
Chainguard says it scanned 52,000 open-source packages used by AI-generated and 'vibe-coded' applications and concluded the long-running default, that the ingredients are safe to assume trustworthy, no longer holds. For CI/CD owners, that pushes dependency scrutiny upstream of the build.
Jun 16, 2026 · Tomás Vega