All your packages are belong to us (Interview)
Socket CTO and former npm CTO Ahmad Nassri joins Adam Stacoviak to discuss the escalating crisis in open-source software supply chain security. They examine how autonomous AI agents hallucinate dependencies and get hijacked by prompt-based malware, why time-to-exploit has dropped to hours, and how worms like Shai-Hulud propagate across package registries. Nassri also shares why he still insists on reading every line of AI-generated code while transitioning into the AI-native developer era.
- Ahmad Nassri, CTO of Socket and former CTO of npm, strips out automated agent skills and treats models strictly as research assistants and fast typists. Read →
- Frontier AI models regularly invent plausible, non-existent package names based on descriptive phrasing, creating an open target for attackers to register them first. Read →
- The average time between a CVE disclosure and an active real-world exploit collapsed from 2.3 years in 2018 to roughly eight hours today, according to data from 0dayclock.com. Read →
- Adam Stacoviak identifies the 2025-2026 window as the boundary line between developers who learned by manually writing code and an incoming wave of AI-native operators. Read →
- Socket now tracks nearly 12,000 compromised packages every week, up from an earlier baseline of 4,000. Read →
- Package managers like pnpm popularized package cooldown periods, but pausing installs gives developers a false sense of safety while delaying critical security fixes. Read →