Everything on Dependency Management

Agents often lack the social proof heuristics humans use to evaluate open-source packages, making them susceptible to 'slop squatting' attacks involving hallucinated or maliciously named libraries.

Impact: Engineering teams must enforce strict package verification and allow-listing to prevent agents from installing compromised dependencies that bypass traditional reputation checks.

— from Securing Agentic Development: Context Supply Chain Risks · The AI Native Dev - from Copilot today to AI Native Software Development tomorrow· May 19, 2026