Coding Agents Are Pulling Packages Your Security Team Can't See

Organizations spent years hardening their software supply chains: routing dependencies through governed repositories, applying curation policies, scanning for vulnerabilities, and maintaining audit trails of what entered the build. Coding agents just opened a new path around all of it.

What Happened

JFrog’s research documents a governance gap that emerged as AI coding agents — Cursor, Claude Code, GitHub Copilot Agent — became standard developer tools. Unlike human developers who work within IDE environments connected to governed package repositories, these agents autonomously pull dependencies directly from public registries based on natural language prompts.

The scale of the exposure is not theoretical. Malicious npm package activity surged 451% in 2025, reaching more than 171,000 unique malicious packages. Nearly 20% of AI-generated package recommendations reference packages that do not exist — enabling “slopsquatting” attacks where threat actors register malicious packages under names that AI models predictably hallucinate. The packages are real; the agents just invented the names, and attackers have learned to register those names ahead of the requests.

The existing governance tooling — Artifactory curation policies, repository allowlists, dependency scanning — is not applied to agent-driven downloads, because those downloads don’t route through the controlled infrastructure those tools were built to protect.

Why It Matters for Builders

The governance gap has a specific shape. Human developers work within configured package manager settings that point their package lookups at Artifactory or another governed proxy. Those settings are established during developer onboarding and enforced at the repository level. Coding agents operate outside that session context unless explicitly configured to use the same infrastructure — which most teams have not done.

JFrog’s response — agent package resolution — works through three enforcement layers:

Session steering routes agent requests to Artifactory by providing governed repository URLs at session initialization rather than assuming the agent will use correctly configured package manager settings.

Persistent configuration binds package managers to governed repositories as a one-time setup, making the governed path the default for both human and agent-driven package resolution.

Server-side enforcement through JFrog Curation blocks non-compliant packages at the repository layer regardless of how the request was initiated, closing the gap that agent-specific session configuration alone would leave open.

The architecture is designed to bring agent-driven development under existing governance without requiring developer workflow changes or agent-specific tooling — the same curation policies that apply to human-initiated builds apply to agent-initiated builds.

Source: JFrog

Content created with AI assistance and reviewed for accuracy.