--- title: npm was already the most attacked package ecosystem.... description: Autonomous AI coding agents now install npm packages without human review, breaking the long-standing 'pause and check' assumption behind npm security... canonical: https://daily.dev/posts/npm-was-already-the-most-attacked-package-ecosystem-then-ai-agents-got-write-access--mdgajsqzw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm was already the most attacked package ecosystem. Then AI agents got write access. | daily.dev og:description: Autonomous AI coding agents now install npm packages without human review, breaking the long-standing 'pause and check' assumption behind npm security... og:url: https://daily.dev/posts/npm-was-already-the-most-attacked-package-ecosystem-then-ai-agents-got-write-access--mdgajsqzw og:image: https://api.daily.dev/og/posts/mDgAjSqZw.png og:image:alt: npm was already the most attacked package ecosystem. Then AI agents got write access. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm was already the most attacked package ecosystem. Then AI agents got write access. **[Cyber Security](https://daily.dev/sources/cyber_sec)** · [@julia7](https://daily.dev/julia7) · 2 min read · 4 upvotes · 1 comments ## Summary Autonomous AI coding agents now install npm packages without human review, breaking the long-standing 'pause and check' assumption behind npm security practices. Two emerging attack patterns exploit this: slopsquatting, where attackers register hallucinated package names that LLMs consistently recommend (found in nearly 1 in 5 recommendations across 16 LLMs), and an MCP bridge vulnerability enabling remote code execution the moment an agent connects to an untrusted MCP server. Traditional SAST/SCA scanners can't detect either because they only parse code, not agent behavior or MCP server activity. This follows three major npm supply chain incidents (Shai-Hulud, axios, SAP) in eight months. ## Content 𝐒𝐡𝐚𝐢-𝐇𝐮𝐥𝐮𝐝. 𝐚𝐱𝐢𝐨𝐬. 𝐒𝐀𝐏. Three major npm supply chain incidents in eight months, each one different, each one exploiting the same assumption: that a human would eventually notice. Agentic coding assistants broke that assumption. They don't suggest packages anymore. They install them, autonomously, mid-task, without a human reading the name first. The classic "pause and check" that underpinned every npm security practice for 15 years is simply gone for a growing chunk of installs. Two attack patterns are already running against this gap. Slopsquatting: research across 16 LLMs found nearly 1 in 5 recommended packages didn't exist. The same hallucinated names came up across repeated prompts, which makes them farmable. Register the name, drop the payload, wait for an agent to install it. MCP RCE: a critical vulnerability in a widely downloaded MCP bridge triggered full remote code execution the moment a client connected to an untrusted server. Agents make those connections autonomously. No user interaction required. Neither attack shows up in a traditional SAST or SCA scan. Those tools parse code. They have no concept of what an agent is about to install or what an MCP server is doing. Worth reading if you run any agentic tooling or care about supply chain threats: [𝐧𝐩𝐦 𝐏𝐚𝐜𝐤𝐚𝐠𝐞 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲: 𝐖𝐡𝐚𝐭 𝐂𝐡𝐚𝐧𝐠𝐞𝐬 𝐖𝐡𝐞𝐧 𝐘𝐨𝐮𝐫 𝐀𝐈 𝐀𝐠𝐞𝐧𝐭 𝐑𝐮𝐧𝐬 𝐭𝐡𝐞 𝐈𝐧𝐬𝐭𝐚𝐥𝐥.](https://xygeni.io/blog/npm-package-security-for-the-age-of-ai-agents/?utm_source=dailydev&utm_medium=post&utm_campaign=cybersec-squad) 𝐁𝐮𝐢𝐥𝐝 𝐟𝐚𝐬𝐭. 𝐒𝐭𝐚𝐲 𝐬𝐞𝐜𝐮𝐫𝐞. --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/npm-was-already-the-most-attacked-package-ecosystem-then-ai-agents-got-write-access--mdgajsqzw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/npm-was-already-the-most-attacked-package-ecosystem-then-ai-agents-got-write-access--mdgajsqzw","headline":"npm was already the most attacked package ecosystem. Then AI agents got write access.","text":"Autonomous AI coding agents now install npm packages without human review, breaking the long-standing 'pause and check' assumption behind npm security practices. Two emerging attack patterns exploit this: slopsquatting, where attackers register hallucinated package names that LLMs consistently recommend (found in nearly 1 in 5 recommendations across 16 LLMs), and an MCP bridge vulnerability enabling remote code execution the moment an agent connects to an untrusted MCP server. Traditional SAST/SCA scanners can't detect either because they only parse code, not agent behavior or MCP server activity. This follows three major npm supply chain incidents (Shai-Hulud, axios, SAP) in eight months.","url":"https://daily.dev/posts/npm-was-already-the-most-attacked-package-ecosystem-then-ai-agents-got-write-access--mdgajsqzw","datePublished":"2026-09-03T09:02:14.050Z","dateModified":"2026-09-03T09:02:33.901Z","author":{"@type":"Person","name":"Julia","url":"https://daily.dev/julia7","image":"https://media.daily.dev/image/upload/s--Vye82kCe--/f_auto/v1752235114/avatars/avatar_JI6NHO2CHs2BU4FFm4NUw?_a=BAMClqZW0","description":"DevSecOps Lover and Software Supply Chain Security Advocate | Solutions Manager at Xygeni","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":240}},"image":"https://media.daily.dev/image/upload/s--pCfOs89S--/f_auto/v1788422261/posts/y2BsJAPc6?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/cyber_sec","name":"Cyber Security"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cyber Security","item":"https://daily.dev/squads/cyber_sec"},{"@type":"ListItem","position":3,"name":"npm was already the most attacked package ecosystem. Then AI agents got write access."}]} ```