react-codeshift

A developer found that npm package existence checks are no longer effective against AI-hallucinated package names, which are being registered by attackers in a practice called 'slopsquatting'. The dev…

A USENIX Security study analyzing 16 popular code-generation models across over 500,000 code samples found that a measurable percentage of AI-suggested package names do not exist in public registries,…

A security analysis by DryRun Security found that 87% of pull requests from AI coding agents contained at least one vulnerability, while Veracode's report showed 45% of AI-generated code samples have …