Generative AI Exacerbates Software Supply Chain Risks

The report warns that generative AI hallucinations frequently invent nonexistent software package names, which malicious actors then register on public repositories and populate with malware (credential stealers, cryptominers, or backdoors). This attack vector threatens software supply chains at scale because developers may trust AI recommendations without verifying packages; the document cites large volumes of malicious package uploads and calls for stronger AI transparency, provenance, SBOM adoption, and a risk-disclosure framework modeled on NIST guidance to restore trust and reduce supply-chain risk.