AI Coding Agents Exploited in Rising Supply Chain Attacks

In 2026 attackers increasingly exploited AI coding agents and package dependency resolution to carry out supply-chain attacks: PromptMink (attributed to a North Korean group) and a compromised Mastra AI framework introduced malicious packages that executed during installation, highlighting growing malicious activity across npm and PyPI and the insufficiency of current vulnerability prioritization and security controls.