Bloom Security Finds 1,500 npm Packages Vulnerable to AI-Driven Supply Chain Attacks
Research reveals how automated AI coding tools could install malicious code via compromised npm packages, exposing enterprises to significant supply-chain risks.
Key points
- Bloom Security identified over 1,500 npm packages vulnerable to a publishing attack involving GitHub repository addresses.
- These vulnerable packages have accumulated more than 10 million downloads, posing a widespread risk to software supply chains.
- AI coding agents install dozens of packages monthly, increasing the volume of automated code execution without human review.
Bloom Security discovered that more than 1,500 npm packages are vulnerable to a publishing attack that exploits weaknesses in software infrastructure, according to a report by The Next Web. The flaw, dubbed SlugFest, allows attackers to potentially inject malicious code into the software supply chain without needing to steal user credentials.
The affected packages have collectively recorded more than 10 million downloads, indicating a broad exposure across the developer ecosystem. The vulnerability specifically targets the npm Trusted Publishing mechanism, which relies on GitHub Actions workflows to obtain short-lived OpenID Connect tokens. This intersection of automated publishing and installation workflows creates a pathway for untrusted code to enter enterprise environments.
The Role of AI Coding Tools
The risk is amplified by the rapid adoption of AI coding assistants that automate software dependency management. Bloom Security’s research indicates that a typical enterprise endpoint receives approximately 70 packages installed by AI agents each month. Developer machines experience even higher volumes, with AI agents installing up to 350 packages monthly. This high frequency of automated installations reduces the likelihood of manual security reviews for each dependency.
Individual AI agents install between 0.3 and 1.2 packages per day, depending on the specific agent type and configuration. Developer workstations often run two to three direct package installations daily. These figures represent only the direct installations and do not account for the transitive dependencies that those packages pull in, meaning the total software footprint is likely larger than reported.
Enterprise Exposure and Real-World Incidents
The scale of AI-driven installation activity creates numerous opportunities for malicious code to execute within an organization. Packages often run installation scripts, such as postinstall hooks, automatically upon installation. Since AI agents select and execute this code on behalf of developers, there is a reduced chance for individual scrutiny of every dependency before it runs.
Bloom Security reported a real-world incident where its platform blocked a customer’s AI agent from attempting to install one of the vulnerable packages. This event demonstrated the practical intersection between automated development workflows and the supply-chain vulnerabilities identified in the SlugFest research. It highlights how enterprise security teams must now monitor not just human-initiated installs, but also automated agent behavior.
What should you do?
Organizations should monitor their software supply chains for unusual installation patterns, particularly those initiated by automated tools. Security teams need to assess the permissions granted to AI coding agents and ensure they are limited to necessary actions. Reviewing the packages installed by these agents can help identify potential risks before they execute harmful scripts.
What to do and how to stay safe: npm
- Audit the permissions of AI coding agents to ensure they cannot install packages from untrusted sources without approval.
- Monitor installation logs for high volumes of package installs, which may indicate automated workflows bypassing security checks.
- Implement strict policies for reviewing postinstall hooks and other scripts that execute during package installation.
- Once the vendor provides an update, apply patches immediately to mitigate the risk of credential-less publishing attacks.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many npm packages are affected by the SlugFest vulnerability?
Bloom Security identified more than 1,500 npm packages that are vulnerable to this publishing attack.
What is the download volume of the affected packages?
The vulnerable packages have accumulated more than 10 million downloads in total.
How many packages do AI agents install on developer machines monthly?
Developer machines can approach 350 packages installed by AI agents each month.
