VIBE CODING SECURITY MONTHLY — JUN 13 - JUL 13, 2026

June ended with the Miasma worm proving that the AI coding agent’s own config files are attack surface. This month the supply chain story kept moving — and got a vocabulary. On July 9, Socket confirmed a compromise of @injectivelabs/sdk-ts, an npm package with ~50,000 weekly downloads, whose malicious release hooks wallet key-derivation functions and exfiltrates private keys and mnemonics through fake telemetry. Four days later, VentureBeat put a name on the AI-native variant of the same threat class: slopsquatting — attackers weaponizing the package names AI coding tools invent. And on the same day the term landed, the defense stack answered: Aptos Labs and Trail of Bits shipped rust-review, a Claude Code plugin for Rust security reviews, while GitLab and Google Cloud announced a fully managed DevSecOps platform built around Gemini and Gemma. The throughline of the month: the software supply chain has absorbed the AI era on both sides — AI output is now a delivery vector, and AI review is now a production defense.

How to read this monthly

This digest is for founders, AppSec, and platform engineers who already ship with AI assistants. We prioritize actionable incidents over rumor: named packages, named techniques, and controls you can implement the same week. Engagement stats from X are context for culture, not evidence of exploitability. Vendor case-study numbers are labeled as such.

Pair this monthly with the weeklies linked below when you need day-by-day chronology; the monthly is for throughlines — this month, supply chain absorbing AI on both offense and defense.

TL;DR — The month in one paragraph

• Injective SDK compromised on npm, Jul 9. Socket detected a supply chain compromise in @injectivelabs/sdk-ts (~50,000 weekly downloads, 87 npm dependents). The malicious release (v1.20.21) hooks wallet key-derivation functions, records private keys and mnemonics, and exfiltrates them through fake telemetry. Socket’s technical breakdown confirms impact on direct installs plus 17 pinned scoped packages.
• “Slopsquatting” enters the vocabulary, Jul 13. VentureBeat frames the successor to typosquatting: AI coding tools hallucinate or recommend package names, attackers publish malware under those names, and the assistant itself becomes the distribution channel.
• rust-review ships, Jul 13. Aptos Labs and Trail of Bits released a security-review plugin for Rust (a Claude Code plugin) targeting exactly what the compiler does not catch: misused unsafe code, silent overflows, nondeterminism. Shipped alongside a new Testing Handbook chapter.
• AI SAST at scale. A ZeroPath case study describes Aptos Labs running AI-powered static analysis across 1M+ lines of Rust, reporting 8x faster vulnerability discovery and 20+ hours/week saved — vendor-reported numbers, directional, but a concrete data point that AI review is in production at L1-blockchain scale.
• GitLab + Google Cloud go managed, Jul 13. Google Open Source announced a fully managed DevSecOps platform pairing GitLab with Gemini and Gemma models, pitched at enterprises that want AI-integrated security with data control and compliance intact.
• The culture layer kept score. The month’s highest-engagement post was a one-liner — “The purpose of the C programming language is to expose memory safety vulnerabilities” — at 5,988 likes and 173k views, while a thread from Inference Labs on attackers targeting AI tooling and development pipelines drew 185 replies on the “secure by design from day one” principle.

What happened to the Injective SDK on npm?

On July 9, Socket reported a software supply chain compromise in @injectivelabs/sdk-ts — the TypeScript SDK for the Injective blockchain, at roughly 50,000 weekly downloads with 87 npm dependents. The malicious release, v1.20.21, does something more surgical than the usual credential-stealer: it hooks the SDK’s own wallet key-derivation functions, records private keys and mnemonics as they are generated or used, and exfiltrates them disguised as telemetry traffic. Socket’s full writeup confirms the blast radius includes direct installs plus 17 pinned scoped packages that carry the compromised version.

Two details make this a vibe-coding story and not just a crypto story. First, the exfiltration channel: fake telemetry is designed to survive exactly the kind of casual review that AI-generated and AI-assisted projects get — an outbound analytics call is the most plausible-looking line of code in any modern SDK. Second, the target selection: an SDK that sits in the key-derivation path is the supply chain equivalent of the Miasma campaign’s agent-config files — code that runs with maximum trust at exactly the moment the most valuable secret exists in memory. June’s waves hit RedHat and Microsoft namespaces; July’s hit a wallet SDK. The pattern — trusted namespace, poisoned release, install-time or runtime harvest — is now monthly cadence, not news.

What to do: if anything in your dependency tree touches @injectivelabs/sdk-ts, treat every key and mnemonic that passed through an affected install as compromised and rotate. More generally: pin versions, put an install cooldown on critical dependencies (block versions younger than 48–72h), and use an SCA layer that flags behavioral changes — a wallet SDK that suddenly grows telemetry is a behavioral diff, not a CVE, and version-number scanning will never catch it.

Why does “slopsquatting” getting a name matter?

On July 13, VentureBeat published “Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools.” The mechanic it names: AI coding assistants hallucinate plausible-looking package names or recommend marginal ones, attackers observe which names models repeatedly invent, and publish malware under exactly those names. Typosquatting exploited human fingers; slopsquatting exploits model output — and the developer most likely to npm install an unvetted suggestion is precisely the vibe coder who let the assistant pick the dependency in the first place.

Names matter operationally. “Typosquatting” took years to travel from research curiosity to a default check in registries and SCA tools; a term is what lets a threat get a detection rule, a policy line, and a budget. The concept itself is not new — package hallucination research predates the label, and it is the exact risk our package hallucination scanner exists for — but July 2026 is the month the AI-native supply chain threat became nameable in a security review. It also closes a loop with the month’s other signal: the Inference Labs thread from June 23 (241 likes, 185 replies) arguing that attackers now target AI tooling, development pipelines, and software supply chains as primary infrastructure. Slopsquatting is that thesis reduced to a single word: the AI tool is not adjacent to the supply chain — it is a supply chain node.

What to do: treat AI-suggested dependencies as untrusted input. Gate them the way you gate AI-generated code: verify the package exists, check its age, publisher, and download history before first install, and run a hallucination check on manifests in CI. A package that was first published days ago and matches a name an LLM plausibly invents is a red flag regardless of how clean its README looks.

What does the rust-review launch signal about AI-assisted defense?

The same day the slopsquatting piece ran, the defense side shipped. Aptos Labs announced rust-review, a security-review plugin for Rust built by their security team with Paweł Płatek of Trail of Bits — released as a Claude Code plugin, alongside a new chapter of the Trail of Bits Testing Handbook. The pitch is precise about its lane: Rust’s compiler gives you memory safety, but it will not flag misused unsafe code, silent overflows, or nondeterminism. rust-review targets the gap between the language’s guarantees and the bugs that actually ship.

The context that makes this more than a tool announcement is the ZeroPath case study on the same organization: Aptos Labs running AI-powered static analysis across 1M+ lines of Rust, reporting 8x faster vulnerability discovery and 20+ hours per week saved. Those are vendor-published numbers from a case study — directional, not audited — but the shape of the claim is the story: a security team at an L1 blockchain, one of the highest-stakes codebases there is, is putting AI review into the production path and co-shipping tooling with a firm of Trail of Bits’ reputation. Note the symmetry: the month’s emerging attack (slopsquatting) and its most credible new defense (rust-review) both run through the same interface — an AI coding agent. The agent is the vulnerability injector and the reviewer now.

And the culture already knew. The month’s loudest post was @schteppe’s “The purpose of the C programming language is to expose memory safety vulnerabilities” — 5,988 likes, 173k views — with the obligatory sarcastic rejoinder (“memory safety is not a real problem, you just have to program good \s”) trailing it. Memes are not data, but 173k views on a memory-safety one-liner is a decent proxy for where developer consensus sits: the language-level argument is over, and the fight has moved to what the compiler cannot see.

What to do: if you run Rust, pilot rust-review on your unsafe blocks — that is the exact surface it was built for, and it slots into a Claude Code workflow you may already have. More broadly, add an AI-review gate to the same pipeline that your AI code generation feeds: the SAST tools that understand AI code are no longer speculative, and the teams shipping them are publishing their scaling numbers.

What does GitLab + Google Cloud’s managed DevSecOps platform change?

Also on July 13, Google Open Source announced that GitLab and Google Cloud are delivering a fully managed DevSecOps platform: enterprises get the GitLab pipeline with Gemini and Gemma models integrated, while — per the announcement’s framing — keeping “strict control over data and compliance.” It is the month’s platform-maturity marker: AI-integrated security is no longer a bolt-on scanner or a beta assistant, it is a managed enterprise product category with two major vendors’ names on it.

The security read cuts both ways. For the buy side, this is genuinely useful: most organizations doing vibe-speed development have no dedicated AppSec function, and a managed platform with security in the default path raises their floor. That squares with the month’s talent signal — a widely shared career-paths post (104 likes) put DevSecOps Engineer and Application Security Engineer at the center of the cybersecurity job map, and demand for those roles is precisely why “managed” is the pitch. But the concentration risk is real too: a managed DevSecOps platform with integrated AI models is itself the kind of high-trust, high-privilege supply chain node this month’s incidents teach you to worry about. Eric Wright’s reflection on why “DevSecOps” needed the Sec spelled out — “because we didn’t put Sec into DevOps” — is the historical warning label: security you outsource to a platform default is security you stopped thinking about.

What to do: if you evaluate the GitLab/Google offering (or any managed DevSecOps product), scope it like infrastructure, not like a tool: where do the models run, what code and secrets do they see, what happens to pipeline security when the platform itself has an incident. The vendor’s compliance story is the start of the assessment, not the conclusion.

The month’s smaller stories

• The AppSec-is-doomed take, again. msuiche argued the contrarian line in a thread about frontier-model codegen bugs: “there will be a near future where models write code with no bugs so appsec will die.” It is a minority position — and this month’s dataset is its own rebuttal: the same 30 days produced a new AI-driven attack class (slopsquatting) and a new AI-driven review tool (rust-review). The equilibrium is not fewer bugs, it is a faster loop on both sides.
• The supply chain checklist got a pipeline-shaped update. Umer Alvi’s widely-echoed point: supply chain attacks are no longer about vulnerable libraries — they target CI/CD pipelines, GitHub Actions, and secrets, so workflow-file review, dependency-update audits, and outbound-connection monitoring are baseline now. Veracode’s best-practices guidance — visibility, continuous monitoring, dependency management, secure CI/CD, risk-based remediation — made the rounds via @anthony_barkley as the checklist version of the same shift.
• Secure-by-design found its audience. The Inference Labs thread (Jun 23) on attackers targeting AI tooling and pipelines pulled 185 replies — unusual engagement depth for an AppSec post, and a sign the “AI infrastructure is operational infrastructure” framing is landing outside the security bubble.

Why this month’s stories rhyme

June’s weeklies ended on the agent’s config files as attack surface. This month widened the lens: the whole AI-assisted development loop is now a supply chain, and every node in it got a story.

• The trusted package fell. Injective’s SDK carried a wallet-key harvester to ~50k weekly downloads through the most trusted channel there is: npm install of a name everyone already depended on.
• The AI suggestion became a vector. Slopsquatting names the case where the package was never trustworthy — the assistant invented it, and an attacker was waiting.
• The defense moved into the same loop. rust-review and production AI SAST put the reviewer inside the coding agent; GitLab and Google Cloud put security inside the managed pipeline. Defense is colocating with the threat.
• The culture already priced it in. A memory-safety one-liner outdrew every technical post 25-to-1. Developers know where the bugs live; the open question of the month is whether review — human or AI — moves as fast as generation.

The settled fact of the month: “supply chain security” and “AI coding security” stopped being separate categories. The attacker’s entry points and the defender’s tooling now run through the same agents, the same registries, and the same pipelines.

Deeper analysis: fake telemetry as social engineering for code review

The Injective payload’s choice of telemetry is not cosmetic. Modern SDKs are expected to phone home: product analytics, crash reporting, feature flags, “anonymous usage.” Reviewers — human or AI — pattern-match outbound HTTPS to known categories and move on. Malware authors know this.

Implications for vibe-coded projects:

1. AI-generated apps paste SDKs whole. A Cursor user who accepts “add Injective wallet support” may never read the SDK’s network layer. The assistant rarely diffs transitive behavior across versions.
2. Lockfiles create false calm. Pinning 1.20.21 feels responsible; it is catastrophic if that exact version is malicious. Pinning is necessary but not sufficient — you need provenance and behavioral review on upgrades.
3. Crypto is the canary, not the boundary. Wallet keys are maximally valuable, so criminals prioritize them. The same hooking technique applies to SDKs that touch Stripe secrets, cloud credential providers, or session mints.

Defensive engineering detail: instrument your build or runtime to inventory unexpected destinations. Even a coarse allowlist for production egress (only your API, your IdP, your payment provider) would have made fake telemetry scream. Most serverless SaaS allow arbitrary egress from Edge Functions — convenient for demos, ideal for exfil.

Deeper analysis: slopsquatting as a closed feedback loop with models

Typosquatting is open-loop: attackers guess human typos. Slopsquatting is closed-loop with model training and decoding:

Model samples package name → developer installs
     ↑                              │
     └──── attackers watch popular hallucinations ──┘

Research and scanner practice already showed models invent package names. Naming the threat slopsquatting matters because:

• Procurement can ban “assistant-proposed deps without registry review” as a control.
• SCA vendors can ship rules: “package age < N days AND name entropy/shape matches LLM priors.”
• IDE vendors can refuse to emit npm install for packages that fail existence/age checks (some have started; coverage is uneven).

For vibe coders the operational rule is blunt: the chat message is not a bill of materials. Generate a lockfile, then review the BOM as if a stranger emailed it to you — because in effect the model did.

Secondary risk: version hallucination (real package, wrong version tag) and import path confusion (package exists, wrong subpath) — less discussed than pure name invention but common in agent transcripts. CI should fail on unresolved imports and on fresh packages, not only on npm audit CVEs.

Deeper analysis: defense colocating with the agent

rust-review as a Claude Code plugin is strategically important beyond Rust. It signals that the industry’s bet is:

The same agent surface that writes the bug will host the reviewer.

Pros:

• Low friction — developers already live in the agent UI.
• Context-rich — the plugin sees the same files the author just generated.
• Fast loop — review before PR, not after prod.

Cons and failure modes:

• Shared fate: if the agent is prompt-injected, the reviewer plugin may be steered to dismiss findings.
• Capability theater: a green “AI reviewed” badge without severity gates becomes compliance decoration.
• Language coverage skew: Rust + blockchain teams get tools first; TypeScript SaaS — where vibe coding volume is highest — still relies on generic SAST that misses RLS and BOLA.

The correct architecture is defense in depth: agent-side review plus CI SAST/SCA plus runtime/dynamic probes on preview URLs. No single plugin replaces vibe pentesting against a live deploy.

Deeper analysis: managed DevSecOps and concentration risk

GitLab + Google Cloud’s managed offering is the enterprise answer to “we cannot hire AppSec fast enough.” That demand is real — the career-map posts are lagging indicators of headcount panic.

Concentration risk checklist for any managed AI-DevSecOps platform:

Eric Wright’s reminder — DevSecOps needed “Sec” spelled out because DevOps omitted it — applies recursively: managed Sec can omit thinking. Use the platform to raise the floor; keep ownership of threat models for your actual product (RLS, tenant isolation, payment webhooks).

Connecting July to June: agent config → registry → pipeline

Three-month arc for readers of this series:

Attackers are not replacing techniques; they are covering the whole AI software factory:

IDE rules → suggested packages → npm install → CI actions → runtime SDK

Defenders who only run npm audit on Fridays miss four of five nodes. Defenders who only fear “AI writing SQLi” miss the supply chain where the AI never wrote the malicious line — it only selected it.

What this month means for Lovable/Bolt/Cursor apps specifically

Vibe-coded web apps feel far from a Cosmos SDK. They are not:

1. They install aggressively. One-click integrations pull dozens of transitive packages. A compromised utility in the tree is enough.
2. They trust scaffolding. Generators emit dependency lists without age gates.
3. They deploy with CI templates copied from blogs — unpinned actions, wide GITHUB_TOKEN — see CI/CD security guide.
4. They ship browser bundles that make application secrets easy to steal even when the registry is clean — different failure mode, same “speed over verification” culture.

July’s supply-chain story and our ongoing RLS story share a root: verification is not part of the default generator loop. Until it is, monthly digests will keep rhyming.

Metrics worth tracking inside your org (post-July)

If you need KPIs for leadership after sharing this digest:

• % of production deps with publish age > 30 days at first use
• Median time from new action version → SHA pin in your workflows
• Count of agent-proposed packages rejected by hallucination CI per week
• Mean time to rotate after SCA critical
• % of preview deploys with dynamic security scan
• Ownership RACI for “AI tooling security” (named human, not “the intern’s Cursor”)

Vanity metric to avoid: “we enabled AI code review” without measuring escaped defects.

Contrarian corner: will AppSec die?

msuiche’s “models write code with no bugs” line is useful as a stress test for strategy. If you believed it fully, you would fire AppSec and buy more GPUs. July’s simultaneous launch of attack vocabulary (slopsquatting) and defense tooling (rust-review, managed DevSecOps) is empirical pushback: capability increases both generation and exploitation bandwidth.

A more plausible equilibrium:

• Fewer certain classes of bug (maybe memory safety in new greenfield Rust).
• More system-level bugs (authz, supply chain, prompt injection, tenant isolation).
• AppSec work shifts from line-by-line review toward pipeline governance, dynamic testing, and identity.

That is not AppSec dying; it is AppSec becoming infrastructure.

Manual checklist — 10 things to verify yourself

1. Audit your tree for @injectivelabs/sdk-ts (and its 17 pinned scoped packages). If v1.20.21 was ever installed, rotate every private key and mnemonic that machine could reach — the payload harvested them at derivation time.
2. Diff the outbound behavior of your critical dependencies, not just their versions. The Injective payload hid in fake telemetry. An SDK that grows a new outbound endpoint is a finding even when no CVE exists.
3. Enable an install cooldown (48–72h) on production dependency updates. Every compromise in this month’s and last month’s data had a window measured in hours to days; a cooldown outlives most of them.
4. Run a hallucination check on every AI-suggested dependency before first install. Verify registry age, publisher history, and download curve. Days-old package + plausible LLM-shaped name = slopsquatting profile.
5. Treat AI-suggested packages as untrusted input in policy, not just in habit. Write it into the review gate: new dependencies proposed by an assistant need the same approval as new vendor code.
6. Review your CI/CD workflow files and GitHub Actions permissions this week. The pipeline, not the library, is the modern target — check for over-scoped tokens, unpinned actions, and secrets reachable from PR-triggered workflows.
7. If you run Rust, inventory your unsafe blocks and pilot rust-review against them. That is the surface the compiler does not cover and the tool was built for.
8. If you adopt AI SAST, demand your own baseline before trusting vendor multipliers. “8x faster discovery” is a case-study number; measure detection and false-positive rates on your codebase first.
9. Scope any managed DevSecOps platform as a high-privilege supply chain node. Document what code, secrets, and build artifacts the platform’s AI models can see, and what your blast radius is if the platform itself is compromised.
10. Assign explicit ownership for AI-coding-tool risk. The career-path demand signal is real because the gap is real: someone on the team must own “what our agents install, read, and execute” as a standing responsibility, not a side quest.

Extended checklist — five more for AI-native teams

11. Egress allowlists for production functions that handle keys or payments — make surprise telemetry expensive.
12. SBOM generation on every release and storage for incident reconstruction.
13. Separate npm tokens for CI publish vs developer laptops; revoke laptop tokens on offboarding the same day.
14. Tabletop: “Malicious version on a core SDK” — who detects, who rotates, who notifies customers?
15. Read last month’s agent-config guidance — supply chain includes skills and rules files, not only package.json.

Related coverage

• Vibe Coding Security Weekly — June 8, 2026 — Sophos catches Cursor+Claude building malware, Miasma plants agent-config payloads in 73 Microsoft repos, RedHat npm falls
• Vibe Coding Security Weekly — June 1, 2026 — OX’s 62%, the Moltbook reference breach, GitHub weighs PR controls
• Package Hallucination Scanner — the free tool for exactly the slopsquatting risk this month named
• Your CLAUDE.md Is Attack Surface — the agent-side threat model that this month’s supply chain stories extend
• SAST Tools for AI-Generated Code — where rust-review and AI-powered SAST fit in a vibe coding pipeline
• The Integration Layer Is the Real Security Gap — why install-time and pipeline-time is where these attacks land
• Poisoned CI and DevOps Leaks — the pattern behind the CI/CD-as-target shift
• 2026 AI Coding Security Report — the year-scale numbers behind this month’s incidents

Incident deep-dive: hooking key derivation

Wallet SDKs sit on the hottest data in process memory: seeds and private keys at the moment of derivation. A malicious release that wraps those functions is higher ROI than a generic env stealer.

Why vibe teams miss it

1. Dependency bots merge “patch” versions automatically.
2. AI assistants say “update to latest” without behavioral review.
3. Outbound HTTPS to “telemetry” looks normal in code review and in AI summaries.
4. Lockfiles pin the bad version faithfully.

Detection ideas beyond CVE matching

• Diff installed package tarball against previous version for new network calls
• Runtime egress allowlists in production (wallet apps especially)
• SCA tools that flag behavioral/capability changes, not only advisories
• 48–72h install cooldown on critical financial dependencies

npm ls @injectivelabs/sdk-ts 2>/dev/null || true
rg -n "injectivelabs" package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null || true

If you were ever on v1.20.21 (or the 17 scoped pins Socket documented), rotate every key and mnemonic that machine could access—treat as material compromise, not theoretical.

Slopsquatting operational playbook

AI suggests name → attacker registered name → npm install → postinstall/runtime malware

CI gates

# Fail if package published < 14 days ago (example policy)
node scripts/check-dep-age.js --min-days 14
# Fail if AI-touched package.json adds names not in allowlist
node scripts/check-new-deps.js --from-main

Manual review for any package with: low downloads, brand-new scope, README full of badges but empty repo, maintainers with no history. Use Package Hallucination Scanner on manifests after agent sessions.

IDE-side: Prefer assistants that verify registry existence before emitting install commands. When they do not, humans must.

rust-review and AI SAST: where they fit vibe stacks

Most vibe volume is TypeScript SaaS, not Rust L1s. Still take the signal:

Do not replace dynamic deploy tests with “AI reviewed the PR.” Shared-fate prompt injection can steer both author and reviewer agents.

Managed DevSecOps buyer questions (expanded)

1. Model inference region and retention for source code
2. Secret redaction before prompts/logs
3. Who can weaken pipeline security policy-as-code
4. Break-glass if vendor outage freezes deploys—do you ship unprotected?
5. How model version changes are validated (false-negative risk)
6. Whether the platform appears in your customer-facing SBOM

Raise the floor with managed platforms; keep threat models for your product (tenants, webhooks, RLS) in-house.

Connecting offense and defense through the agent loop

Rules/skills → suggested packages → registry install → CI actions → runtime SDK

July’s stories hit registry and naming; June’s hit rules/skills; CI remains a standing target. Teams that only npm audit weekly cover one node.

Org KPIs after sharing this digest

• % of prod deps with publish age > 30 days at first use
• Median time from action release → SHA pin
• Agent-proposed packages rejected by CI per week
• MTTRotate after SCA critical
• % previews with dynamic security scan
• Named owner for AI tooling security (RACI)

Avoid vanity: “AI code review enabled” without escaped-defect metrics.

Tabletop: malicious SDK version

Facilitator injects “Socket-like alert on core SDK.” Teams must: detect (who watches?), freeze deploys, inventory installs, rotate secrets/keys, customer comms, root-cause install path (auto-merge?). Time the exercise. Gaps become backlog items, not blog feelings.

What not to over-learn from crypto

Injective is crypto-flavored; the pattern is not. Any SDK that handles cloud credentials, session minting, or payment secrets is a high-value hook target. Apply the same telemetry suspicion to “analytics” additions in auth and billing libraries.

Fake telemetry as social engineering for code review

Modern SDKs are expected to phone home: product analytics, crash reporting, feature flags. Reviewers—human or AI—pattern-match outbound HTTPS to known categories and move on. Malware authors know this.

Implications for vibe-coded projects:

1. AI-generated apps paste SDKs whole. A Cursor user who accepts “add wallet support” may never read the SDK’s network layer.
2. Lockfiles create false calm. Pinning 1.20.21 feels responsible; it is catastrophic if that exact version is malicious.
3. Crypto is the canary, not the boundary. The same hooking technique applies to Stripe secrets, cloud credential providers, or session mints.

Defensive engineering: instrument build or runtime to inventory unexpected destinations. Coarse allowlists for production egress (only your API, IdP, payment provider) make fake telemetry scream. Most serverless SaaS allow arbitrary egress from Edge Functions—convenient for demos, ideal for exfil.

Version hallucination and import-path confusion

Secondary to pure name invention: real package with wrong version tag; package exists with wrong subpath. CI should fail on unresolved imports and on fresh packages, not only on npm audit CVEs.

July takeaways for AI-native shipping teams

1. Treat telemetry-capable SDKs as high-trust supply-chain nodes—diff network behavior on upgrades.
2. Encode slopsquatting checks in CI: package age, maintainer history, hallucination scan after agent sessions.
3. Put AI review and dynamic preview scans in the same loop; neither alone is enough.
4. Scope managed DevSecOps like infrastructure: model data path, secret redaction, break-glass, SBOM disclosure.
5. Assign a named owner for AI tooling risk; RACI beats “everyone’s Cursor.”

Sources

• Socket — Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics — July 2026; announcement post, July 9, 2026
• VentureBeat — Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools — July 13, 2026
• Trail of Bits — Rust-proof your code with our new Testing Handbook chapter — July 13, 2026; Aptos Labs rust-review announcement
• ZeroPath — How Aptos Labs Scales Application Security Across 1M+ Lines of Rust with AI-Powered SAST — 2026 (vendor case study)
• Google Open Source — GitLab + Google Cloud managed DevSecOps announcement — July 13, 2026
• Veracode — Top Software Supply Chain Security Best Practices — referenced July 2026
• Community posts cited inline: @schteppe, @inference_labs, @ualvi27, @anthony_barkley, @msuiche, @discoposse, @Ahmed___khaan, @maomao_2325

This digest is compiled from a curated set of 12 public X posts (June 13 – July 13, 2026) cross-referenced against official vendor sources — a high-signal sample, not an exhaustive scrape. Engagement figures are point-in-time snapshots. The ZeroPath performance numbers (8x discovery, 20+ hours/week) are vendor case-study claims and should be read as directional. “Slopsquatting” is an emerging term whose usage may evolve. VibeEval is not affiliated with Socket, Injective Labs, Trail of Bits, Aptos Labs, ZeroPath, VentureBeat, GitLab, Google, Veracode, or any other organization cited. Questions? Contact our team.