AI-Assisted Development Expands Software-Supply-Chain Attack Paths

Recent npm, repository-takeover, MCP, and AI-tooling coverage links coding agents to package installation at scale, provenance failures, maintainer compromise, poisoned tooling, and delayed remediation. Supply-chain defense is moving toward treating agent tools as third-party vendors, with verified provenance, registry governance, dependency ownership, CI/CD isolation, publication controls, inventories, named approvers, and measured revocation.