Record · corpus.blog/posts/01a0cfe4-35e6-7255-882e-0ff5d92e2755

The Dependency Trap: Supply Chain Risks in AI-Generated Code (Part 4)

simonroses.com · published 8 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at simonroses.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 27
Words captured: 3,527

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

What Is Vibe Coding Security? A Field Guide for 2026 (Part 1) Read at the source ↗

simonroses.com

The OWASP Top 10 for Vibe-Coded Applications (Part 2) Read at the source ↗

simonroses.com

Anatomy of a Vibe Coding Breach: Lessons from 2026’s Worst Incidents (Part 3) Read at the source ↗

simonroses.com

Authentication & Secrets: What AI Gets Wrong Every Time (Part 5) Read at the source ↗

simonroses.com

Prompt Engineering for Secure Code (Part 7) Read at the source ↗

simonroses.com

The Founder’s Security Checklist: Shipping a Vibe-Coded MVP Without Getting Hacked (Part 8) Read at the source ↗

simonroses.com

Securing the AI Coding Pipeline (Part 9) Read at the source ↗

simonroses.com

The Future of Vibe Coding Security (Part 10) Read at the source ↗

simonroses.com

https://www.endorlabs.com/lp/state-of-dependency-management-2025

endorlabs.com

https://sethmlarson.dev/slopsquatting

sethmlarson.dev

https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-742-spracklen.pdf

usenix.org

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26) Read at the source ↗

unit42.paloaltonetworks.com

https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem

cisa.gov

https://nx.dev/blog/s1ngularity-postmortem

nx.dev

https://www.gitguardian.com/

gitguardian.com

https://socket.dev/blog/malicious-open-source-packages-2025-mid-year-threat-report

socket.dev

https://socket.dev/

socket.dev

https://www.vulnex.com/

vulnex.com

https://npmscan.com/

npmscan.com

https://security.snyk.io/

security.snyk.io

https://x.com/SimonRoses

x.com

https://simonroses.com/2026/04/anatomy-of-a-vibe-coding-breach-part-3/

simonroses.com

https://simonroses.com/2025/12/skill-poisoning-the-ai-supply-chain-attack-nobodys-talking-about/

simonroses.com

The Shadow Twin Threats: When AI and Vibe Coding Go Rogue in Your Network Read at the source ↗

simonroses.com

https://www.lasso.security/blog/ai-package-hallucinations

lasso.security

https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks

socket.dev

Scanning Vibe-Coded Apps: Why Traditional SAST/DAST Falls Short (part 6) Read at the source ↗

simonroses.com