--- title: Your AI Assistant Is Choosing Your Dependencies | daily.dev description: AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your... canonical: https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your AI Assistant Is Choosing Your Dependencies | daily.dev og:description: AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your... og:url: https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd og:image: https://api.daily.dev/og/posts/0TBWWoRKD.png og:image:alt: Your AI Assistant Is Choosing Your Dependencies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your AI Assistant Is Choosing Your Dependencies **[Foojay.io](https://daily.dev/sources/foojayio)** · 12 min read · 1 upvotes · 1 comments ## Summary AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your behalf. Maven's namespace verification and lack of install scripts offer some protection versus npm, but transitive dependencies, plugins that execute code during the build lifecycle, and hallucinated or outdated package recommendations remain real risks. North Korean threat actors (tracked as HexagonalRodent by Expel) are using the same AI tools at scale to generate malware and even to test whether their malicious code can evade AI-assisted code review. Practical defenses for Java/Maven developers include running mvn dependency:tree, mvn help:effective-pom, mvn help:effective-settings, and mvn dependency:resolve-plugins to audit what an AI assistant actually changed, plus scanning for end-of-life dependencies with tools like HeroDevs' EOL scanner. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What Maven command shows which plugins and their dependencies were actually resolved in my build? Run mvn dependency:resolve-plugins, which explicitly resolves all project plugins and reports their dependencies. This differs from mvn dependency:tree, which only shows the normal application dependency tree including transitive dependencies, not build plugins. Use mvn help:effective-pom to see the fully resolved POM after inheritance and active profiles are applied. _Developers auditing AI-generated build changes can find similar Maven security guidance curated on daily.dev._ ### Why can't I just trust Maven Central to keep my Java dependencies safe from AI-selected packages? Maven Central requires domain ownership verification for new namespaces and JARs don't run install scripts like npm packages, but this creates a false sense of safety. Maven automatically resolves transitive dependencies beyond what you typed, and Maven plugins can execute arbitrary code during build phases like compile, test, or package, so an AI assistant modifying your pom.xml, adding a plugin, parent POM, or BOM deserves the same scrutiny as a new library. _Java developers weighing AI-assisted build changes can track supply-chain risks like these on daily.dev._ ### How did North Korean hackers use AI tools against AI-assisted code review, according to Expel's research? A crew tracked as HexagonalRodent used mainstream AI tools to generate malware, build infrastructure, and create fake companies to lure developers, and prompted US-owned AI models to audit their malicious code for signs of malware. This meant the attackers used AI to verify their malware could survive a target's AI-assisted security review before deploying it. _Security-conscious developers evaluating AI coding tools can follow reporting like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pedropietro** · 0 upvotes >  ## Similar posts on daily.dev - [Why Java Developers Over-Trust AI-Generated Code](https://daily.dev/posts/why-java-developers-over-trust-ai-generated-code-ewcn5arji) · Foojay.io · 0 upvotes · 0 comments - [AI-Powered Dependency Decisions Introduce, Ignore Security Bugs](https://daily.dev/posts/ai-powered-dependency-decisions-introduce-ignore-security-bugs-dtwphetcl) · Dark Reading · 0 upvotes · 0 comments - [Software dependencies are running away from us](https://daily.dev/posts/software-dependencies-are-running-away-from-us-8ly2du4kw) · InfoWorld · 0 upvotes · 0 comments - [Coding Agents Just Reopened Your Software Supply Chain Blind Spot](https://daily.dev/posts/coding-agents-just-reopened-your-software-supply-chain-blind-spot-qam3brqhm) · JFrog · 0 upvotes · 0 comments - [The Risk Profile of AI-Driven Development](https://daily.dev/posts/the-risk-profile-of-ai-driven-development-7pov4rgla) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#vibe-coding](https://daily.dev/tags/vibe-coding), [#maven](https://daily.dev/tags/maven) [View this post on daily.dev](https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your AI Assistant Is Choosing Your Dependencies","url":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd"},"datePublished":"2026-08-18T14:08:55.143Z","dateModified":"2026-09-14T07:42:43.370Z","description":"AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d14062034332d4904801a0ae5d9f9be7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d14062034332d4904801a0ae5d9f9be7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Foojay.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Foojay.io","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1820f6a6ae944760aa322b67ed85f848","url":"https://daily.dev/sources/foojayio"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"java,vibe-coding,maven","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Foojay.io","item":"https://daily.dev/sources/foojayio"},{"@type":"ListItem","position":3,"name":"Your AI Assistant Is Choosing Your Dependencies"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd","comment":[{"@type":"Comment","text":"","datePublished":"2026-08-18T17:46:07.887Z","url":"https://daily.dev/posts/0TBWWoRKD#c-MZ5Rqf8ms","author":{"@type":"Person","name":"Pedro Pietroluongo","url":"https://daily.dev/pedropietro","image":"https://avatars.githubusercontent.com/u/1533471?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd#faq","mainEntity":[{"@type":"Question","name":"What Maven command shows which plugins and their dependencies were actually resolved in my build?","acceptedAnswer":{"@type":"Answer","text":"Run mvn dependency:resolve-plugins, which explicitly resolves all project plugins and reports their dependencies. This differs from mvn dependency:tree, which only shows the normal application dependency tree including transitive dependencies, not build plugins. Use mvn help:effective-pom to see the fully resolved POM after inheritance and active profiles are applied. Developers auditing AI-generated build changes can find similar Maven security guidance curated on daily.dev."}},{"@type":"Question","name":"Why can't I just trust Maven Central to keep my Java dependencies safe from AI-selected packages?","acceptedAnswer":{"@type":"Answer","text":"Maven Central requires domain ownership verification for new namespaces and JARs don't run install scripts like npm packages, but this creates a false sense of safety. Maven automatically resolves transitive dependencies beyond what you typed, and Maven plugins can execute arbitrary code during build phases like compile, test, or package, so an AI assistant modifying your pom.xml, adding a plugin, parent POM, or BOM deserves the same scrutiny as a new library. Java developers weighing AI-assisted build changes can track supply-chain risks like these on daily.dev."}},{"@type":"Question","name":"How did North Korean hackers use AI tools against AI-assisted code review, according to Expel's research?","acceptedAnswer":{"@type":"Answer","text":"A crew tracked as HexagonalRodent used mainstream AI tools to generate malware, build infrastructure, and create fake companies to lure developers, and prompted US-owned AI models to audit their malicious code for signs of malware. This meant the attackers used AI to verify their malware could survive a target's AI-assisted security review before deploying it. Security-conscious developers evaluating AI coding tools can follow reporting like this via daily.dev."}}]} ```