Analysis
Software supply chain security: a defense-in-depth guide
Publication date unknown · Discovered cloudsmith.com
Page published
Publication date unknown · First observed: 7 Nov 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
AI coding agents can introduce malicious dependencies through hallucinated package names, making agent-driven package selection an important supply-chain trust boundary.
Cloudsmith’s defense-in-depth guide examines software supply-chain trust boundaries, including slopsquatting, where attackers publish malicious packages under names hallucinated by AI coding agents. The broader guide distinguishes detection from enforcement and explains how malicious package-install scripts can steal credentials before pipeline scans run.