# AI Supply Chain Risks > [!abstract] What this note is > The software around AI tools, including extensions, skills, MCP servers, libraries, and the packages a model recommends, has become a target of its own. This note covers the incidents that show how, and the habits that limit the damage. Part of [[AI Security for Users]]. Sources checked 2026-09-13. ## Everything you add is software A skill is instructions plus scripts. An MCP server is a program. An extension updates itself. A package a model suggests is someone's code, or it doesn't exist yet and is waiting to be registered by whoever gets there first. All of them run with your access. ## Packages the model invents Models sometimes recommend dependencies that don't exist. A USENIX Security 2025 study generated 2.23 million code samples and found **19.7% of recommended packages were hallucinated**, 205,474 unique names in all. Open-source models did this far more than commercial ones (21.7% against 5.2%) [1]. The names are often plausible and repeat across prompts, so an attacker can register them and wait. Seth Larson of the Python Software Foundation named this **slopsquatting** [2]. **Before installing a package a model suggested,** confirm it exists, check how old it is, who maintains it and how widely it's used, and make sure the name is exactly the one you meant. ## Official tools, compromised - **Amazon Q Developer (July 2025).** Version 1.84.0 of the VS Code extension shipped with an injected prompt instructing the agent to wipe local files and cloud resources. AWS says the code failed to run because of a syntax error, and no customer was affected. Version 1.85.0 removed it [3]. It reached users through the official channel. - **Nx "s1ngularity" (August 2025).** Malicious versions of a popular build tool were published to npm. On install, they used AI command-line tools already on the machine (Claude, Gemini, Q) to search for secrets, then posted the results to public repositories [4][5]. The victim's own AI assistant did the searching. - **LiteLLM (March 2026).** Two releases of a widely used AI gateway library on PyPI, 1.82.7 and 1.82.8, carried credential-stealing code. They were live for about 40 minutes [6]. ## Marketplaces for skills and servers Agent ecosystems now have storefronts, and the storefronts have malware. An audit of one open skills marketplace in February 2026 found **341 malicious skills out of 2,857**. Palo Alto Networks' Unit 42 reported in June 2026 that malicious skills were still getting through [7]. A marketplace listing tells you that something was uploaded, not that it is safe. ## Your AI tools as the payload SANDWORM_MODE (February 2026) closed the loop. An npm worm installed a **rogue MCP server** into the configuration of several AI coding tools, so the next time the user's assistant started, the attacker's server was part of it [8]. See [[Agents and Connectors]]. ## Habits that limit the damage 1. **Install less.** Every extension, skill and server is ongoing trust, not a one-time decision. 2. **Read a skill before installing it.** They are usually short, and the instructions are the part that runs. 3. **Pin versions and use lockfiles.** Updating the moment a release lands is how you get the 40-minute window. 4. **Wait a few days on new releases** of anything that holds credentials. 5. **Check your AI tools' configuration** for servers and plugins you didn't add. 6. **Keep secrets out of reach.** An assistant that can read your whole home directory can be made to read your keys. 7. **Remove what you no longer use.** ## Sources 1. [Spracklen et al., "We Have a Package for You!" — USENIX Security 2025](https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen) 2. [Slopsquatting: how AI hallucinations are fueling a new class of supply chain attacks — Socket, Apr 2025](https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks) 3. [Security bulletin AWS-2025-015 — AWS, 23 Jul 2025](https://aws.amazon.com/security/security-bulletins/AWS-2025-015/) 4. [s1ngularity postmortem — Nx](https://nx.dev/blog/s1ngularity-postmortem) 5. [s1ngularity supply chain attack — Wiz](https://www.wiz.io/blog/s1ngularity-supply-chain-attack) 6. [Security update, March 2026 — LiteLLM](https://docs.litellm.ai/blog/security-update-march-2026) 7. [OpenClaw and AI supply chain risk — Unit 42, Palo Alto Networks, Jun 2026](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/) 8. [SANDWORM_MODE: npm worm poisons AI toolchains — Socket, 20 Feb 2026](https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning) ## Related - [[AI Security for Users]] — the section overview - [[Agents and Connectors]] — MCP servers and permissions - [[Claude Code Skills]] — what a skill is, in a working vault