The AI Supply Chain Trap: Attackers Use AI, Devs Ship Slop, And Only Review Can Save Us
Theme of this issue: Three major supply chain attacks in two weeks. Same attacker (TeamPCP). AI made attacks cheaper and smarter. Meanwhile, AI makes devs ship untested code faster. The gap is the problem. Multi-model AI review is the answer.
🎯 Hook
Three supply chain attacks in two weeks. Same attacker (TeamPCP) hitting npm, VS Code extensions, and developer tools. AI helped them write better malware, analyze targets faster, and automate exploitation.
Meanwhile, developers use the same AI tools to generate code at 10x speed. PRs balloon. Code quality drops. The k10s dev spent 7 months vibe-coding a Kubernetes dashboard with Claude — ended up with a 1690-line god object, a data race, and an archived project.
The paradox: AI created both the acceleration problem and the solution. Not as a code writer — as a code reviewer.
🔥 Hot Take
"Attackers use AI to exploit. Devs use AI to ship slop. Only AI-powered review can close the gap."
AI-generated attacks are cheaper, faster, and more sophisticated. The TanStack worm uses OIDC token extraction — a technique known since 2024 but not fixed because review couldn't keep up with deployment speed.
Meanwhile, AI-generated code introduces issues that persist at 22.7% rate across 300K+ commits (Liu et al., 2026). More code, less review, more attack surface.
The fix isn't slower shipping. It's automated, multi-model security review matching AI generation speed. If your review pipeline can't keep up with your generation pipeline, attackers will exploit the gap.
💬 My take: Write code yourself. Let AI review everything. Multi-model debate eliminates false positives. It's the only asymmetric advantage defenders have against AI-powered attackers.
📰 Top Articles
1. TanStack Mini Shai-Hulud Worm — npm Supply Chain Compromise
TL;DR: 84 malicious npm versions across 42 @tanstack/* packages. Attack chain: pull_request_target → GitHub Actions cache poisoning → OIDC token extraction from runner /proc/<pid>/mem → worm self-propagation. Persists in Claude Code hooks and VS Code tasks — npm uninstall is NOT enough. Now expanding to PyPI.
How AI helped the attacker:
- Mass-analyzed GitHub Actions workflows for security flaws
- Generated 2.3MB obfuscated malicious code
- Wrote worm self-propagation logic
My take: This is the most sophisticated npm supply-chain attack ever. The three-step chain (pull_request_target → cache poisoning → OIDC extraction) is terrifying because each step alone is harmless — together they're game over. The worm surviving npm uninstall by hooking into Claude Code and VS Code tasks is a new persistence model we haven't seen before. Check your lockfiles for SHA fingerprint 79ac49ee.
2. GitHub Breach — 3,800 Repos via Malicious VS Code Extension
TL;DR: TeamPCP again. One trojanized VS Code extension installed by a GitHub employee → 3,800 internal repos exfiltrated. $50K+ asking price on dark web. GitHub detected and contained within the day.
How AI helped the attacker:
- Created realistic-looking extension with malicious payload
- Automated social engineering campaigns at scale
- Generated convincing documentation to pass marketplace review
My take: The irony is painful. GitHub — the company that hosts half the world's source code — got compromised because someone installed a plugin. The VS Code Marketplace is the new npm. Same supply chain crisis cycle. Extensions with millions of installs carrying malware. The platform lacks verification and signing rigor matching its scale. And with AI coding agents making VS Code the central dev tool, compromising the extension ecosystem is higher leverage than ever.
3. Obsidian Plugin → PHANTOMPULSE RAT
TL;DR: Attackers pose as VCs on LinkedIn, share an Obsidian vault, convince targets to enable community plugins → malicious plugin drops PHANTOMPULSE RAT via process injection. C2 resolved via Ethereum blockchain — decentralized, impossible to takedown. Targets finance and crypto professionals.
How AI helped the attacker:
- Cross-platform payload generation (Windows + macOS)
- Ethereum transaction embedding for decentralized C2
My take: The technical sophistication (blockchain C2, memory-only payload, cross-platform) is high. But the actual attack vector is "please enable community plugins." Trust is the vulnerability. If you use Obsidian, never enable plugins in a vault you didn't create yourself. The blockchain C2 is genuinely scary though — no server to takedown, no domain to seize.
4. Armin Ronacher — Building Pi With Pi
TL;DR: Flask creator dogfoods Pi to build Pi — but the tracker is drowning in LLM-generated junk (3,145 external issues/PRs in 90 days, <10% PR merge rate). Core argument: AI makes local workarounds cheap, eroding upstream collaboration and global invariants.
Key quote: "AI has not increased the number of people who need software, or the number of maintainers who can review it. It has mostly increased the amount of code."
My take: This is the most important quote in the entire issue. More code + same reviewers = more attack surface. Supply chain attacks become more attractive because targets increased 10x. Ronacher's observation maps directly to the security problem: all that AI-generated code needs review, but there aren't more reviewers. AI must fill the review gap — or attackers will exploit it.
5. Nolan Lawson — Using AI to Write Better Code More Slowly
TL;DR: The antidote to vibe-coding slop. Multi-model PR review skill: run Claude sub-agent + Codex + Cursor Bugbot on every PR. Cross-reference findings. Fix criticals/highs before merging. "Always finds tons of bugs" with near-zero false positive rate.
My take: This is the playbook. Nolan's insight: AI is really good at finding bugs. Throw multiple models at any unscrutinized codebase and they find more than you know what to do with. The debate pattern (multiple independent models, cross-reference findings) eliminates hallucinations. The workflow is simple:
Write code by hand → Open PR → Run 3 AI reviewers →
Fix criticals/highs → Re-review → Merge
Not: Prompt → Generate → Ship → Hope
🛠️ Tools & Releases
- Multi-Model PR Review Skill — Run Claude + Codex + Bugbot on every PR. Cross-reference catches false positives. Nolan reports near-zero false positive rate.
- SSCGuard — Academic tool detecting supply-chain threats in LLM-generated code. Tested 439K prompts, found 11 threat categories across GPT and Llama.
- Chain-of-Confirmation — Prompt-based defense: force model to confirm each dependency before generating. Reduces fabrication and hallucinated packages.
- Debt Behind the AI Boom — Liu et al. (Apr 2026): 22.7% of AI-introduced issues survive at latest repo version across 302K+ AI commits. Quantifies the slop problem.
💡 Dev Tip of the Week
Multi-model PR review: catch what one model misses.
# Example workflow (adapt to your CI)
# Run independent model reviews on each PR
claude-code review --pr $PR_NUMBER --output /tmp/review-claude.md
codex review --pr $PR_NUMBER --output /tmp/review-codex.md
cursor-bugbot review --pr $PR_NUMBER --output /tmp/review-bugbot.md
# Cross-reference findings
# Keep: findings present in 2+ reviews (high confidence)
# Flag: findings in only 1 review (review manually)
# Critical/High: fix before merge
# Medium/Low: fix or backlog
Why it matters: Multiple independent models eliminate the hallucination problem. If two models find the same bug independently, it's real. This is the asymmetric defense against AI-powered attackers.
Also: Check your own tooling for persistence hooks after supply-chain incidents:
# Find Mini Shai-Hulud payload
find node_modules -name "router_init.js" -size +1M
# Check Claude Code hooks
ls -la ~/.claude/ && cat ~/.claude/settings.json | grep -E 'router_runtime|setup\\.mjs'
# Check VS Code task persistence
ls -la .vscode/tasks.json 2>/dev/null && cat .vscode/tasks.json | grep -E 'setup\\.mjs|router_runtime'
🤔 Community Question
❓ Is multi-model AI code review the only scalable defense against AI-powered supply chain attacks? Attackers use AI to generate exploits and automate targeting. Devs use AI to ship code at 10x speed. Human review can't scale. Is the answer more AI — or do we need a fundamentally different approach to code trust?
📌 What I'm Learning / Building
Dove deep into the TeamPCP campaign this week — traced the connection between TanStack worm, GitHub breach, and Obsidian plugin attacks. Same group, evolving playbook. The pattern is clear: attack developer tooling, not application code. VS Code extensions, npm packages, Obsidian plugins — the supply chain is the vector, and AI makes every step cheaper.
Also reading the academic literature: Liu et al.'s recent pre-print on 302K AI commits is sobering — 22.7% issue persistence rate. Waseem et al. on vibe coding practices confirms what the k10s experience showed: AI generates features, not architecture. The god-object is the default AI artifact.
Synthesizing all this into a concrete recommendation for our CI pipeline: multi-model PR review with independent agents, cross-referenced findings, and automated critical/high gates. Starting with a prototype this week.
Academic references
- Liu, Widyasari, Zhao et al. (Apr 2026) — Debt Behind the AI Boom: 302K AI commits studied — arXiv 2603.28592
- Waseem et al. (Dec 2025) — Vibe Coding in Practice: Flow, Technical Debt, Guidelines — arXiv 2512.11922
- Li & Gao (Sep 2025) — Security Implications of AI-Generated Code on Supply Chain — arXiv 2509.20277
- Negri-Ribalta et al. (2024) — SLR on AI models and security of code generation — Frontiers in Big Data
- Hu et al. (2025) — LLM supply chain: Open problems from security perspective — ACM CCS