---
id: 2415
title: "Everybody's shipping code they can't read"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/shipping-code-they-cant-read"
published_at: "2026-06-25 00:00"
tags: ["ai-security", "supply-chain", "open-source", "malware", "npm", "ai-agents", "vibe-coding", "developer-tools", "supply-chain-security", "ai-coding-agents", "dependencies", "mastra", "crypto-wallets", "crypto-wallet-theft"]
phying_url: "https://phying.com/item/2415"
lang: en
---

# Everybody's shipping code they can't read

## Summary

AI agents let anyone ship code they never read, including dependencies they never chose—a risk underscored by the Mastra attack, where 141 republished npm packages delivered wallet-stealing malware.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-06-25 00:00
- **Original:** https://www.aikido.dev/blog/shipping-code-they-cant-read
- **Phying News:** https://phying.com/item/2415