Your AI Assistant Is Choosing Your Dependencies
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your behalf. Maven's namespace verification and lack of install scripts offer some protection versus npm, but transitive dependencies, plugins that execute code during the build lifecycle, and hallucinated or outdated package recommendations remain real risks. North Korean threat actors (tracked as HexagonalRodent by Expel) are using the same AI tools at scale to generate malware and even to test whether their malicious code can evade AI-assisted code review. Practical defenses for Java/Maven developers include running mvn dependency:tree, mvn help:effective-pom, mvn help:effective-settings, and mvn dependency:resolve-plugins to audit what an AI assistant actually changed, plus scanning for end-of-life dependencies with tools like HeroDevs' EOL scanner.
Table of contents
So Vibe Coders?Java isn’t npm. Good. Don’t relax.What Price Code AI Gen?Crossing ecosystems can be bad for your (app) healthThe weakest link?Defences for Java DevelopersYour repository configuration is part of the attack surface tooWhat if you can’t just upgrade?Vibe coding take twoThe factory bought the same toolsAnd the old attacks didn’t go awayThe candidate is doing fine, by the wayQuestions this post answers
Which Maven command shows all plugin dependencies resolved for my project?
Run mvn dependency:resolve-plugins to explicitly resolve all project plugins and report their dependencies. This differs from mvn dependency:tree, which shows the normal application dependency tree including transitives but does not surface build plugins, and from mvn help:effective-pom, which shows resolved configuration like plugins and repositories after inheritance but not a plugin dependency tree. daily.dev surfaces practical Maven security workflows for teams auditing AI-generated build changes.
Why is Java considered safer than npm for AI-generated dependencies but still risky?
Maven Central requires publishers to prove domain control before publishing under a namespace, and resolving a JAR does not trigger arbitrary code execution the way an npm install script can. However, Maven auto-resolves transitive dependencies beyond what you explicitly add, and Maven plugins can execute code during build phases like compile or package, so an AI assistant modifying the build itself is a distinct and under-scrutinized risk. developers weighing java versus node dependency risk can track these nuances on daily.dev.
How are attackers using AI to evade AI-assisted code review of malicious dependencies?
A North Korean group tracked as HexagonalRodent by Expel has prompted US-owned AI models to audit their own malicious code and check whether it could survive AI-assisted security review, effectively using AI to test that their malware evades a target's AI code inspection. The same group used mainstream AI tools to build infrastructure, generate malware, and construct fake companies to lure developers. teams evaluating AI-assisted code review can follow emerging supply-chain threats like this on daily.dev.
1.9K Impressions1 Comment