--- title: Your AI Assistant Is Choosing Your Dependencies | daily.dev description: AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your... canonical: https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your AI Assistant Is Choosing Your Dependencies | daily.dev og:description: AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your... og:url: https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd og:image: https://api.daily.dev/og/posts/0TBWWoRKD.png og:image:alt: Your AI Assistant Is Choosing Your Dependencies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your AI Assistant Is Choosing Your Dependencies **[Foojay.io](https://daily.dev/sources/foojayio)** · 12 min read · 1 upvotes · 1 comments ## Summary AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your behalf. Maven's namespace verification and lack of install scripts offer some protection versus npm, but transitive dependencies, plugins that execute code during the build lifecycle, and hallucinated or outdated package recommendations remain real risks. North Korean threat actors (tracked as HexagonalRodent by Expel) are using the same AI tools at scale to generate malware and even to test whether their malicious code can evade AI-assisted code review. Practical defenses for Java/Maven developers include running mvn dependency:tree, mvn help:effective-pom, mvn help:effective-settings, and mvn dependency:resolve-plugins to audit what an AI assistant actually changed, plus scanning for end-of-life dependencies with tools like HeroDevs' EOL scanner. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which Maven command shows all plugin dependencies resolved for my project? Run mvn dependency:resolve-plugins to explicitly resolve all project plugins and report their dependencies. This differs from mvn dependency:tree, which shows the normal application dependency tree including transitives but does not surface build plugins, and from mvn help:effective-pom, which shows resolved configuration like plugins and repositories after inheritance but not a plugin dependency tree. _daily.dev surfaces practical Maven security workflows for teams auditing AI-generated build changes._ ### Why is Java considered safer than npm for AI-generated dependencies but still risky? Maven Central requires publishers to prove domain control before publishing under a namespace, and resolving a JAR does not trigger arbitrary code execution the way an npm install script can. However, Maven auto-resolves transitive dependencies beyond what you explicitly add, and Maven plugins can execute code during build phases like compile or package, so an AI assistant modifying the build itself is a distinct and under-scrutinized risk. _developers weighing java versus node dependency risk can track these nuances on daily.dev._ ### How are attackers using AI to evade AI-assisted code review of malicious dependencies? A North Korean group tracked as HexagonalRodent by Expel has prompted US-owned AI models to audit their own malicious code and check whether it could survive AI-assisted security review, effectively using AI to test that their malware evades a target's AI code inspection. The same group used mainstream AI tools to build infrastructure, generate malware, and construct fake companies to lure developers. _teams evaluating AI-assisted code review can follow emerging supply-chain threats like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pedropietro** · 0 upvotes >  ## Similar posts on daily.dev - [Why Java Developers Over-Trust AI-Generated Code](https://daily.dev/posts/why-java-developers-over-trust-ai-generated-code-ewcn5arji) · Foojay.io · 0 upvotes · 0 comments - [AI-Powered Dependency Decisions Introduce, Ignore Security Bugs](https://daily.dev/posts/ai-powered-dependency-decisions-introduce-ignore-security-bugs-dtwphetcl) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#vibe-coding](https://daily.dev/tags/vibe-coding), [#maven](https://daily.dev/tags/maven) [View this post on daily.dev](https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your AI Assistant Is Choosing Your Dependencies","url":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd"},"datePublished":"2026-08-18T14:08:55.143Z","dateModified":"2026-08-18T14:27:32.547Z","description":"AI coding assistants don't just generate code, they also choose and modify dependencies, build plugins, repository configs, and cross-ecosystem tooling on your...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d14062034332d4904801a0ae5d9f9be7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d14062034332d4904801a0ae5d9f9be7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Foojay.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Foojay.io","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1820f6a6ae944760aa322b67ed85f848","url":"https://daily.dev/sources/foojayio"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"java,vibe-coding,maven","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Foojay.io","item":"https://daily.dev/sources/foojayio"},{"@type":"ListItem","position":3,"name":"Your AI Assistant Is Choosing Your Dependencies"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd","comment":[{"@type":"Comment","text":"","datePublished":"2026-08-18T17:46:07.887Z","url":"https://daily.dev/posts/0TBWWoRKD#c-MZ5Rqf8ms","author":{"@type":"Person","name":"Pedro Pietroluongo","url":"https://daily.dev/pedropietro","image":"https://avatars.githubusercontent.com/u/1533471?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-ai-assistant-is-choosing-your-dependencies-0tbwworkd#faq","mainEntity":[{"@type":"Question","name":"Which Maven command shows all plugin dependencies resolved for my project?","acceptedAnswer":{"@type":"Answer","text":"Run mvn dependency:resolve-plugins to explicitly resolve all project plugins and report their dependencies. This differs from mvn dependency:tree, which shows the normal application dependency tree including transitives but does not surface build plugins, and from mvn help:effective-pom, which shows resolved configuration like plugins and repositories after inheritance but not a plugin dependency tree. daily.dev surfaces practical Maven security workflows for teams auditing AI-generated build changes."}},{"@type":"Question","name":"Why is Java considered safer than npm for AI-generated dependencies but still risky?","acceptedAnswer":{"@type":"Answer","text":"Maven Central requires publishers to prove domain control before publishing under a namespace, and resolving a JAR does not trigger arbitrary code execution the way an npm install script can. However, Maven auto-resolves transitive dependencies beyond what you explicitly add, and Maven plugins can execute code during build phases like compile or package, so an AI assistant modifying the build itself is a distinct and under-scrutinized risk. developers weighing java versus node dependency risk can track these nuances on daily.dev."}},{"@type":"Question","name":"How are attackers using AI to evade AI-assisted code review of malicious dependencies?","acceptedAnswer":{"@type":"Answer","text":"A North Korean group tracked as HexagonalRodent by Expel has prompted US-owned AI models to audit their own malicious code and check whether it could survive AI-assisted security review, effectively using AI to test that their malware evades a target's AI code inspection. The same group used mainstream AI tools to build infrastructure, generate malware, and construct fake companies to lure developers. teams evaluating AI-assisted code review can follow emerging supply-chain threats like this on daily.dev."}}]} ```