Who Vets AI's Code? The Scale Challenge Facing Open Source Ingestion

By Jonny Rivera, Head of Product at ActiveState During our conversations on the show floor at Black Hat last week, one question came up in almost every discussion our team had with AppSec leads, platform engineers, and CISOs: Who is actually vetting AI’s code? Developer adoption of AI coding tools isn't slowing down. The productivity gains are real, and open source software remains the backbone of modern enterprise applications. But as AI coding assistants auto-complete third-party dependency suggestions in milliseconds, enterprise security teams and open source maintainers face a shared operational challenge: code generation has completely outpaced legacy ingestion review. When an unvetted or hallucinated dependency enters a codebase at machine speed, post-commit Software Composition Analysis (SCA) scans struggle to keep pace. Securing this pipeline doesn't mean slowing developers down or restricting open source. It requires governing what enters the environment at the point of selection, before an import ever triggers a build. The Mechanics of "Slopsquatting" and Machine Ingestion Large language models (LLMs) recommend software libraries based on statistical probability and historical code patterns, not real-time package registry verification. When a model suggests a package name that does not exist in PyPI or npm, it creates a supply-chain vulnerability known as slopsquatting (or AI package hallucination exploitation). The scale of this vulnerability vector was highlighted in a USENIX Security study analyzing sixteen popular code-generation models across 500,000+ code samples: A measurable percentage of AI-suggested package names do not exist in public registries. Of the suggested dependencies that do resolve to real packages, nearly half contain known CVEs or outdated releases. Attackers routinely monitor public LLM output patterns and developer code repositories to identify these hallucinated package names. Once identified, an adversary registers the dummy name on PyPI or npm, uploads a malicious payload, and waits for automated developer environments or CI/CD builders to fetch it. [Developer Workspace] ---> [AI Assistant Auto-completes Package Name] | v [Package Name Does Not Exist in Registry] | v [Attacker Registers Name on PyPI/npm with Payload] | v [CI/CD Pipeline Fetches Package] ---> [Compromised Build] This vector is actively being observed in wild deployment. Early in 2026, security researchers tracked a single hallucinated npm package name (react-codeshift) originating from 47 AI-generated agent skills in a single commit. The hallucination spread organically through forks to over 230 repositories before an engineer noticed a human had never explicitly selected it. The issue was not malicious intent by the developer, rather, a complete absence of ingestion controls. Stop AI Package Hallucinations Before They Hit Your Build AI coding assistants generate software at machine speed, but unvetted dependencies expose your pipeline to slopsquatting and supply chain attacks. Powered by a secure repository of clean, built-from-source components, ActiveState lets organizations prove software provenance and build-level attestation while eliminating slopsquatting vectors at the intake step. Talk to our Team