Ned Bellavance • 4/14/2026

Open Source Malware, NPM, and the Risk of Helpful AI

This article examines the growing threat of open source malware, focusing on NPM where over 90% of tracked malicious packages appear. It discusses how JavaScript's massive dependency trees and NPM's low-friction publishing model create large attack surfaces. The piece also explores how AI coding assistants and local agents, when granted broad permissions, are becoming part of the attack chain, making software supply chain security more complex. Includes insights from Open Source Malware co-founder Jenn Gile on practical risks and mitigation strategies for developers.

0 comments

#JavaScript #npm #Software Supply Chain Security