# AI-generated software can introduce malicious dependencies without human review

DevFeed: [AI-generated software can introduce malicious dependencies without human review](<https://devfeed.tech/articles/everybody-s-shipping-code-they-can-t-read-51653.md>)

Original publisher: [Read original article](<https://www.aikido.dev/blog/shipping-code-they-cant-read>)

Author: Samuel Vandamme

Published: 2026-06-25T03:32:00Z

Content type: news

Language: en

Sources: [Aikido Security's Blog](<https://devfeed.tech/sources/aikido-security-s-blog.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm](<https://devfeed.tech/topics/npm.md>), [mastra](<https://devfeed.tech/topics/mastra.md>), [Code](<https://devfeed.tech/topics/code.md>), [Library](<https://devfeed.tech/topics/library.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>), [Pull Request](<https://devfeed.tech/topics/pull-request.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [developer](<https://devfeed.tech/tags/developer.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mastra](<https://devfeed.tech/tags/mastra.md>), [npm](<https://devfeed.tech/tags/npm.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [software](<https://devfeed.tech/tags/software.md>)

## AI overview

The article examines how AI coding agents can produce working software without users reviewing the underlying code or dependencies. It highlights an attack in which malicious packages entered the @mastra AI-agent ecosystem, downloaded additional payloads, and targeted browser crypto wallets across multiple operating systems.

## Source excerpt

With AI, everyone's a developer now, and a lot of code gets shipped without a careful review from trained eyes. Category: News