Everybody's shipping code they can't read
aikido.dev | blog | #ai-security | #supply-chain | #open-source | #malware | #npm | #ai-agents | #vibe-coding | #developer-tools | #supply-chain-security | #ai-coding-agents | #dependencies | #mastra | #crypto-wallets | #crypto-wallet-theft
Summary
AI agents let anyone ship code they never read, including dependencies they never chose—a risk underscored by the Mastra attack, where 141 republished npm packages delivered wallet-stealing malware.
- Published
- Collected
--- id: 2415 title: "Everybody's shipping code they can't read" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/shipping-code-they-cant-read" published_at: "2026-06-25 00:00" tags: ["ai-security", "supply-chain", "open-source", "malware", "npm", "ai-agents", "vibe-coding", "developer-tools", "supply-chain-security", "ai-coding-agents", "dependencies", "mastra", "crypto-wallets", "crypto-wallet-theft"] phying_url: "https://phying.com/item/2415" lang: en --- # Everybody's shipping code they can't read ## Summary AI agents let anyone ship code they never read, including dependencies they never chose—a risk underscored by the Mastra attack, where 141 republished npm packages delivered wallet-stealing malware. ## Intelligence Metadata - **Sources:** aikido.dev - **Published:** 2026-06-25 00:00 - **Original:** https://www.aikido.dev/blog/shipping-code-they-cant-read - **Phying News:** https://phying.com/item/2415