Your AI Coding Agent's Dependencies Are a Supply Chain Risk

Across 59 tracked supply chain campaigns from June 2024 through June 2026, the CVE count during active exploitation was zero. Not low. Zero. That single number should reframe how you think about your AI coding agent’s dependencies, because the packages that actually hurt you aren’t the ones with critical CVEs — they’re the ones that pass every automated trust check you own. Your SBOM saw nothing. Your provenance badge was green. Your scanner was quiet. And the worm was already sitting in the memory recall path, waiting for the next lookup.

What does a zero-CVE supply chain attack look like?

The most dangerous packages aren’t the ones with known vulnerabilities. They’re the ones with valid SLSA provenance, clean SBOMs, and a CVE count of zero — because attackers stopped trying to sneak past your scanner and started stealing the identity that makes your scanner meaningful.

Between 02:23 and 05:55 UTC on September 23, 2026, three compromised versions of the npm package @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and PyPI version 2.0.34 of MemoryOS shipped with a cross-platform Go-based credential stealer named sckit, according to Contra Collective’s analysis of the MemOS compromise. The detail that matters: sckit embeds itself inside the memory recall path rather than using a postinstall hook, so it activates every time an agent’s memory lookup fires. A standard install-time scan never sees it. It’s the first publicly documented worm built specifically to ride inside AI agent memory infrastructure.

Identity theft is the other half of the pattern. Google Threat Intelligence Group documented DUSTMAKER, a credential stealer that extracts OIDC tokens from GitHub Actions runner memory and publishes compromised packages with valid, cryptographically signed SLSA Build 3 attestations that pass AI coding agent automated trust checks. It doesn’t forge a signature — it steals the identity that makes the signature mean something. DUSTMAKER even masquerades its pipeline tasks under names like ‘Copilot Setup’ and deletes workflow logs so a human skimming the build sees nothing odd.

The numbers back this up. On May 19, 2026, 633 malicious npm package versions passed Sigstore provenance verification because the attacker had generated valid signing certificates from a compromised maintainer account — and Sigstore can’t determine whether the credential holder authorized the publish. The Mini Shai-Hulud wave carried cryptographically valid SLSA attestations after the attacker extracted a legitimate OIDC token from runner memory. A compromised release of @7nohe/openapi-react-query-codegen shipped with valid npm provenance published through GitHub Actions OIDC with Sigstore attestations present. The badge was green. The payload was a self-propagating worm.

This is what I call the Identity vs Behavior Gap. Your trust infrastructure verifies who built an artifact. It’s structurally silent on what the artifact does and who actually decided to install it.

How fast are agents installing packages you never approved?

A typical enterprise endpoint receives roughly 70 agent-installed packages per month. Developer machines can approach 350. That’s not a typo — that’s the new baseline, and it bypasses every human review gate you have.

Bloom Security measured that a typical enterprise endpoint receives approximately 70 packages installed by AI agents each month, while developer machines can approach 350. Individual agents install between 0.3 and 1.2 packages per day, the average endpoint runs three agents, and developer machines can run five or more. Those figures exclude transitive dependencies, so the real footprint is larger. Bloom also reported catching and blocking a customer’s AI agent attempting to install one of the packages affected by the SlugFest vulnerability — proof that the attack path isn’t theoretical.

Chainguard CISO Quincy Castro stated that velocity has outpaced governance and controls, and that the traditional request, review, and approve cycle bottlenecks people when code can be generated instantaneously. He’s also doubtful that most security teams have ever effectively reviewed and validated the software components developers use, and he’s clear that AI hasn’t broken a functioning review process — there wasn’t one. Agents just made the volume impossible to ignore.

Some developers report that Claude Code installed 23 packages in under a minute when asked to scaffold an Express API with auth, and three of those packages carried known critical vulnerabilities, including one at CVSS 9.8, without the agent mentioning any of them. Treat the specifics as anecdotal. The pattern isn’t. A 50-developer organization running an average of three AI agents per endpoint would see approximately 105,000 agent-installed packages per year across the fleet [50 endpoints × 70 packages per endpoint per month × 12 months], excluding transitive dependencies. Even if every one of those packages were clean, none of them passed through an approval, an inventory entry, or a human decision.

Why doesn’t your SBOM catch any of this?

Your SBOM is an inventory, not a decision record. It tells you what’s in the box. It can’t tell you who chose the box, whether the chooser was a person or a prompt, or what the code does once it’s running.

An arXiv preprint published July 17, 2026 by Aadesh Bagmar and Pushkar Saraf tested frontier coding agents across twelve scenarios in five attack classes and found that editing a single README, requirements file, or Makefile is enough to redirect an agent toward untrusted registries and known-vulnerable dependencies. The worst class is source redirection: pointing an agent at an attacker-controlled registry instead of swapping a package name caused nearly every model tested across npm and Cargo to install the dependency without flagging it. Your SBOM will faithfully record the poisoned package. It just won’t tell you the agent was tricked into fetching it.

The hallucination problem makes this worse. USENIX Security 2025 research tested 16 models across 576,000 samples and found roughly 19.7% of AI-generated package recommendations referenced packages that do not exist. Attackers register those names and wait. ReversingLabs documented PromptMink, a campaign attributed to Famous Chollima, using a bait package @solana-launchpad/sdk with READMEs crafted to look authoritative to an LLM resolving dependencies. In January 2026, researchers found a legitimate Solana Graveyard Hackathon project that had pulled in @solana-launchpad/sdk through a commit co-authored by Claude Opus.

Registry concentration adds leverage. depthfirst’s initial research found that the top 100 publishing identities account for roughly 66% of npm downloads and 75% of PyPI downloads, and that coding agents may retry blocked installations through alternative package managers, public registries, binaries, or direct tarball URLs. Block one path and the agent routes around it. Meanwhile, AI agents choose tools from shared registries by matching natural-language descriptions, but no human is verifying whether those descriptions are true — and an adversary can publish a tool with prompt-injection payloads in its description that passes code signing, provenance, and SBOM checks.

Which tools actually block malicious packages before install?

Free update automation and CVE scanning won’t stop a worm. You need a behavioral firewall sitting between your agents and the public registries, and you need to know what each layer actually does.

The vendor landscape splits into three layers, and you should know which one you’re buying. Dependabot and Renovate are both free, generate pull requests when new dependency versions are released, do not find vulnerabilities, and Dependabot is described as the right answer for most teams under 50 engineers. Software composition analysis matches dependencies against CVE databases — useful, but blind to zero-CVE worms. The layer that didn’t exist five years ago is the malicious-package firewall: Socket evaluates 70+ behavioral indicators including whether a package reads OAuth tokens from disk or uses marshal.loads to self-deobfuscate. Endor Labs claims their reachability analysis reduces actionable alerts by 90 to 95 percent — marketing language, but the underlying capability is real.

Tool	Pricing	What it actually does	Best for
Dependabot / Renovate	Free	Generate pull requests on new versions; do not find vulnerabilities	Teams under 50 engineers
Socket	From $1,200/year	Evaluates 70+ behavioral indicators before install	Malicious-package firewall coverage
GitHub Advanced Security	$49/user/mo	CodeQL, Dependabot premium, secret protection	GitHub-native monorepos
Semgrep Supply Chain	Free to $40/dev/mo	Custom-rule SCA and scanning	Teams wanting transparent rules
Endor Labs	$20,000+/year	Reachability analysis across transitive dependencies	Enterprise alert-noise reduction

Pricing gets murky fast at the firewall layer. A 50-developer team deploying GitHub Advanced Security with both Code Security and Secret Protection would pay $29,400/year in subscription costs alone [50 developers × ($30 + $19) per committer per month × 12 months]. But a 50-developer team cannot be fully cost-projected for malicious-package firewall coverage because Socket’s published entry price is $1,200/year while its per-developer or per-endpoint scaling tiers aren’t disclosed, and Endor Labs starts at $20,000+/year with no public pricing. Budget for a conversation, not a number.

What configuration changes block agent-driven installs today?

The control point that matters is the device and registry layer where agents install packages — not the CI pipeline where artifacts are signed. Start with the free stuff.

CISA’s guidance after the axios compromise is blunt and cheap. On March 31, 2026, two npm packages for versions axios@1.14.1 and axios@0.30.4 injected the malicious dependency plain-crypto-js@4.2.1 that downloads multi-stage payloads including a remote access trojan. CISA recommends setting ignore-scripts=true in the .npmrc configuration file to prevent potentially malicious scripts from executing during npm install, and setting min-release-age=7 to only install packages published at least seven days earlier. That second one buys you a window for the ecosystem to catch a fresh poison.

Registry-level friction works when it exists. ReversingLabs found that npm malware more than doubled in 2025 and now represents nearly 90 percent of all open source malware the firm detects, while PyPI and NuGet malware declined 43 and 60 percent respectively after those registries shipped mandatory 2FA and trusted publishing. Attackers don’t grind through friction; they route around it. npm’s own Trusted Publishing had a gap: Bloom Security’s SlugFest research found npm’s Trusted Publishing tied trust to a repository’s name rather than its permanent ID, and GitHub shipped a fix on 2 October 2026, almost four months after the report. SlugFest identified more than 1,500 npm packages vulnerable to a publishing attack involving GitHub repository addresses, with the affected packages accumulating more than 10 million downloads.

What about curated registries and agent-specific benchmarks?

If you’d rather not remediate vulnerabilities yourself, curated sourcing is now an option — with caveats. Safeguard opened early access to Gold sourcing on October 15, 2026, letting customers pull Safeguard-fixed open-source components from a private registry at registry.safeguard.sh instead of patching themselves, with support for npm, PyPI, Maven and container images first. Every Gold artifact ships with no known vulnerabilities at last scan and no known malware, and each carries an SBOM, signed SLSA build provenance and a VEX document. That’s a real control for known-vulnerability remediation. It doesn’t solve the zero-CVE worm problem, and the launch targets — 7-day critical fixes under Gold, 72 hours under Gold Live — are targets, not guarantees.

Agent-specific configuration guidance is arriving too. The Center for Internet Security released the CIS MCP Server Benchmark v1.0.0 on Sept. 16, 2026, a consensus-developed set of 55 prescriptive recommendations across 10 security domains including Supply Chain Security and Isolation and Execution Safety. Use it as a floor, not a ceiling. And remember that AI agent tooling vectors including MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks moved from theoretical concern to confirmed delivery mechanism across at least 14 of 59 tracked campaigns. Ungoverned plugin marketplaces are part of the same problem, which is why we’ve argued that AI coding agent plugin marketplaces are a supply chain risk in their own right.

The infrastructure underneath all of this is underfunded, and that’s a risk you can’t patch. The OpenSSF Governing Board recognizes that the current funding model for public package registries is no longer sustainable, and as AI reshapes how software is built and dramatically increases demand on registries, it supports sustainable funding models and intends to participate as an enterprise customer. Translation: expect registry economics to change, and don’t assume the free tier stays free forever.

How do you lock down your AI coding agent’s dependencies?

If your security model assumes a human engineer chose each dependency, you have no model at all. The fix isn’t a single tool — it’s moving your control point from the pipeline to the install.

Here’s the order I’d work in:

1. Kill lifecycle scripts and age-gate installs. Set ignore-scripts=true and min-release-age=7 in .npmrc today. Free, immediate, closes the loudest execution path.
2. Proxy and pin. Route agents through an internal registry and block direct tarball URLs, because agents retry blocked installations through alternative package managers, public registries, binaries, or direct tarball URLs.
3. Add a behavioral firewall if your fleet justifies it. Under 50 engineers, Dependabot plus the .npmrc changes may carry you. Above that, the 105,000-packages-per-year math makes a Socket-class firewall worth the pricing conversation.
4. Audit agent config files as code. ChainDrop used stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and a developer-to-developer infection path. We’ve got the control-by-control version in hardening AGENTS.md and agent config files against poisoning.
5. Treat provenance as identity, not safety. A green badge means a real identity signed it. It doesn’t mean a human authorized it or that the code is safe.

For the end-to-end version — source code through sandbox execution, with enforceable financial and permission limits — our guide to AI agent dependency security covers what standalone inventory tools miss.

The open question isn’t whether your agents will install a compromised package. It’s whether you’ll ever know which one, and whether you’ll be able to prove a human didn’t choose it.