Published:
AI coding assistants, LLM proxy packages, model SDKs, and MCP (Model Context
Protocol) servers are transforming how software is built. They also run inside
developer machines and CI runners with access to source code, environment
variables, cloud credentials, package registry tokens, and deployment pipelines.
That combination of trust and access makes them a high-value supply chain
target, and it makes securing them one of the highest-leverage investments a
team can make.
The encouraging news is that the defenses are well understood, increasingly
built into the tooling, and within reach of teams of every size. This article
explains why AI developer tools are targeted, how the attacks work, and how to
build a practical, resilient defense and response plan.
Why AI developer tools are a high-value target
1. They run with developer privileges.
An AI assistant or CLI usually has the same filesystem, shell, and network
access as the person running it. That often includes SSH keys, cloud CLI
sessions, source code, and local configuration files.
2. They are trusted by design.
Package installers, editor extensions, and MCP servers are expected to run
code automatically, so malicious behavior blends into normal operation.
3. They hold long-lived credentials.
Registry tokens, GitHub tokens, cloud access keys, and model API keys are
frequently stored in environment variables, .env files, ~/.npmrc, and
~/.aws/credentials on the same machine.
4. They have transitive reach.
A popular package or proxy sits between many projects and many models. One
compromised version can harvest credentials from every environment that
installs it.
5. The ecosystem is young.
MCP servers, agent frameworks, and AI-specific packages are often published
by small teams with limited security review and take on privileged roles
quickly.
Recent incidents
The 2025 Shai-Hulud npm worm stole npm tokens and used them to publish
malicious versions of other packages, spreading through the ecosystem. A 2026
wave expanded this technique to AI coding tools, using them to establish
persistence and move across developer environments.
In February 2026, attackers compromised a popular AI proxy package used to
connect applications to multiple LLM providers. The malicious update added
credential theft, lateral movement, and a backdoor.
In April 2026, several AI tool packages were compromised to deliver malware
that harvested credentials, exfiltrated data, and accessed cryptocurrency
wallets.
Attackers also spoof the landing pages of well-known AI developer tools,
standing up fake utility and download pages that deliver wallet drainers or
credential stealers.
Third-party risk is now mainstream. Industry reporting indicates that a large
majority of organizations experienced a material third-party security incident
during 2025. AI tooling adds a new, highly privileged third party to that list.
Each of these incidents also showed the ecosystem at its best. Researchers
published advisories quickly, registry teams removed malicious releases, and
maintainers rotated credentials and added stronger controls. The same
connectivity that helps attacks spread also helps defenders detect, share, and
contain them faster than ever.
Anatomy of an AI supply chain attack
1. Initial access
Typosquatting, dependency confusion, a compromised maintainer account, a
leaked publish token, or a malicious pull request that gets merged.
2. Execution
A preinstall, install, or postinstall script runs automatically, or malicious
code ships inside a package that developers already trust.
3. Credential harvesting
The payload reads environment variables and common credential locations:
AWS_*, GITHUB_TOKEN, NPM_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, ~/.npmrc,
~/.aws/credentials, ~/.ssh, ~/.kube/config, .env, and CI secret files.
4. Exfiltration
Data is sent out over HTTPS or DNS to attacker-controlled infrastructure,
often disguised as telemetry or model API traffic.
5. Propagation
Stolen publish tokens are used to push malicious versions of other packages,
turning the compromise into a worm.
6. Persistence
Modified shell profiles, git hooks, editor tasks, and MCP configuration keep
the attacker present after the initial package is removed.
A related risk is "slopsquatting". An AI assistant can suggest a package name
that does not exist. An attacker registers that name with malicious code, and a
developer installs it while trusting the suggestion.
Why traditional controls miss it
- Installs happen on developer laptops and CI runners, outside centralized
change management.
- Lifecycle scripts are normal, expected behavior in the npm ecosystem.
- Trusted publisher badges and package popularity do not guarantee safety;
established accounts get compromised.
- AI assistants generate confident-looking dependency suggestions that are
rarely verified before install.
- MCP servers and editor extensions often have no formal review process, yet
receive broad filesystem and network permissions.
These gaps are closing. Trusted publishing, provenance attestations,
install-script controls, and agent sandboxing are moving from optional hardening
to default practice across the ecosystem.
Defenders are gaining ground
The direction of travel is genuinely positive:
- Registry signatures and provenance attestations make tampering easier to spot
before code reaches a developer machine.
- Trusted publishing with short-lived OIDC tokens removes the long-lived
credentials that worms need in order to spread.
- Modern AI tools are adding sandboxing, permission prompts, and scoped tool
access by default.
- Security teams now detect suspicious install behavior in minutes instead of
weeks, and indicators of compromise spread across the community at machine
speed.
- Open standards such as SBOM and SLSA give teams a shared language for
verifying what they ship and what they consume.
A prepared team can stop these attacks at several points in the chain. That is a
much better position than the industry had only a few years ago.
Defenses
Dependency hygiene
- Commit and enforce lockfiles. Install with "npm ci" rather than "npm install"
in CI.
- Disable lifecycle scripts by default and allowlist packages that genuinely
need them:
npm config set ignore-scripts true
npm ci --ignore-scripts
pnpm install --ignore-scripts
yarn install --ignore-scripts
- Pin exact versions and delay upgrades of newly published releases until they
have had time for review.
- Use a private registry proxy or an allowlist of approved packages.
- Verify registry signatures and provenance where available:
npm audit signatures
- Generate an SBOM and track every AI SDK, proxy, and MCP server in use.
- Add a human review step for any dependency suggested by an AI assistant,
especially names you have not used before.
Credential and token hygiene
- Replace long-lived registry and cloud keys with short-lived, scoped tokens and
OIDC-based trusted publishing.
- Keep secrets in a CI secret manager, not in .env files on developer machines.
- Give AI tools their own least-privilege identity. Do not reuse personal admin
credentials.
- Never expose production cloud credentials to a developer environment or an
autonomous agent.
- Rotate all tokens after any suspected compromise.
AI assistant and agent controls
- Maintain an allowlist of approved MCP servers and review their source, tool
scopes, and network access before enabling them.
- Run assistants and agents in a sandbox or container with restricted
filesystem and network access.
- Use deny-by-default tool permissions and require approval for shell commands,
outbound network calls, and write operations.
- Do not grant repo-wide write access, package publish rights, or production
credentials to an autonomous agent.
- Review the dependency changes an assistant proposes as carefully as code it
writes.
Network and monitoring controls
- Apply egress filtering and monitor DNS for unexpected destinations from
developer machines and CI.
- Alert on new package publishes from your organization's accounts.
- Flag installs of brand-new packages and packages that make network calls
during install.
- Watch for suspicious child processes such as curl, wget, or node spawning an
unexpected shell inside node_modules.
- Keep CI runners ephemeral and rebuild from clean images after any incident.
Incident response checklist
1. Isolate the affected developer machine or CI runner from the network.
2. Revoke npm, GitHub, cloud, and model API tokens. Rotate every secret that was
present in the environment.
3. Audit recent publishes from your accounts and unpublish or deprecate
malicious versions.
4. Inspect node_modules, lockfiles, git hooks, shell profiles, and MCP
configuration for persistence.
5. Review CI logs and outbound connections for exfiltration.
6. Rebuild affected systems from clean images instead of cleaning in place.
7. If you published a compromised package, notify downstream consumers and the
registry.
Quick reference
# Install without running lifecycle scripts
npm ci --ignore-scripts
# Check registry signatures where supported
npm audit signatures
# Inspect a package before adopting it
npm view <package> time
npm view <package> scripts
Key takeaways
- AI developer tools deserve security attention because they are trusted and
privileged, and that same centrality makes them a powerful place to invest.
- The core defenses are mature and practical: lockfiles, install-script
controls, short-lived tokens, sandboxing, and monitoring.
- Most attacks reuse familiar techniques, which means familiar controls still
work when they are applied consistently.
- Small improvements compound quickly. Every team can start this week.
- Teams that combine good tooling, clear ownership, and a culture of
verification are already reducing both the likelihood and the impact of these
attacks.
References
Recorded Future - AI cyber threat trends 2026:
<https://www.recordedfuture.com/research/ai-cyber-threat-trends-2026>
World Economic Forum - Global Cybersecurity Outlook 2026:
<https://www.weforum.org/publications/global-cybersecurity-outlook-2026/in-full/3-the-trends-reshaping-cybersecurity/>
Fortinet - Cybersecurity trends 2026:
<https://www.fortinet.com/resources/cyberglossary/cybersecurity-trends-2026>
npm - ignore-scripts configuration:
<https://docs.npmjs.com/cli/v10/using-npm/config#ignore-scripts>
A positive outlook
AI is making software development faster and more accessible, and it can make
security stronger in the process. The same automation that attackers abuse can
enforce least privilege, verify every package, and flag anomalies in seconds.
Supply chain security is no longer a specialist concern; it is becoming a
default part of how good teams build.
The advantage belongs to defenders who prepare. Start with one improvement this
week: disable install scripts, add provenance checks, or review the MCP servers
you trust. Each step compounds, and each one makes the ecosystem safer for
everyone who builds on it.
With thoughtful tooling, clear ownership, and a habit of verification, teams can
adopt AI development tools with confidence and keep the advantage on the
defender's side.