dependencies

Generated code ships faster, which is the point and the risk. The scored answer names the specific failure modes and keeps the normal controls working at the new speed.

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Typosquatting waits for a human typo. Slopsquatting waits for a model to invent the same wrong name again, and models repeat themselves.