Hahaha, bloody hell. LLM-generated code often suggests packages that don't exist - so people have uploaded malware with these package names. And Google tells you that the package is safe because its AI summary is just pulling from the package's readme, which tells you it's a lovely safe package.
https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/
"What a world we live in: AI hallucinated packages are validated and rubber-stamped by another AI that is too eager to be helpful."
Toilet full of bugs
npub1z4…j9ed0
2025-04-15 19:57:48 UTC
Author Public Key
npub1z4tfdc2t6nqfjf886ylykr2yfhtfl8n73g3unmqlch4p4y3dwquqvj9ed0Seen on
wss://relay.momostr.pinkPublished at
2025-04-15 19:57:48 UTCEvent JSON
{
"id": "7a30502f03cf7965db76da6da039747864dee86e650b90eb1e12b9343c56a693",
"pubkey": "155696e14bd4c09924e7d13e4b0d444dd69f9e7e8a23c9ec1fc5ea1a922d7038",
"created_at": 1744747068,
"kind": 1,
"tags": [
[
"proxy",
"https://topspicy.social/@ephemeromorph/114343743868519690",
"web"
],
[
"proxy",
"https://topspicy.social/users/ephemeromorph/statuses/114343743868519690",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://topspicy.social/users/ephemeromorph/statuses/114343743868519690",
"pink.momostr"
],
[
"-"
]
],
"content": "Hahaha, bloody hell. LLM-generated code often suggests packages that don't exist - so people have uploaded malware with these package names. And Google tells you that the package is safe because its AI summary is just pulling from the package's readme, which tells you it's a lovely safe package.\n\nhttps://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/\n\n\"What a world we live in: AI hallucinated packages are validated and rubber-stamped by another AI that is too eager to be helpful.\"",
"sig": "34913a369e217abc489da67022c409a4bdf8b8a89e08ed06fb1c9ebe8251dee5273673440bb1eb22a473f3d877af6c0c8c7e998c0470c8c64bd0725f63ea8ca1"
}