OpinionSoftware supply chainAugust 20267 min read
Who signed off on this package?
AI can suggest dependencies. People still have to own them.
Open the report, 7 pagesDownload the PDFAI can find, compare and install dependencies faster than any team. We think people should still own at least 90% of the decision about what goes into your software, and the evidence backs that up.
Key takeaways
Four things to know
- 01
One package is never one package. Adding one npm package means trusting about 79 other packages and 39 maintainers nobody on your team picked.
- 02
Adoption went up while trust went down. In 2025, 84% of developers used or planned to use AI tools. Only 3% said they highly trust the output.
- 03
Models still name packages that do not exist. AI coding models name packages absent from npm and PyPI, and anyone can register those names for free.
- 04
The worst attacks hit packages people already trusted. Tools can flag risk. The approval has to belong to someone who understands the system.
An attacker doesn’t need to fool your team. They only need your team to stop checking.
The detail
The evidence, and the process we recommend
The full piece is in the PDF above. These are the parts worth pulling up on their own.