Full Report
AI coding tools can introduce unvetted or hallucinated open source dependencies faster than traditional security reviews can keep pace. ActiveState explains why organizations should govern packages at the point of selection, before they enter the development pipeline. [...]
Analysis Summary
# Best Practices: Governing AI-Generated Code & Open Source Ingestion
## Overview
As AI coding assistants (GitHub Copilot, Cursor, etc.) achieve 85% enterprise adoption, they have introduced a new supply chain vector: **Slopsquatting** (AI package hallucination). These practices address the "governance gap" where AI-generated code introduces unvetted or non-existent dependencies faster than traditional post-commit security scans can detect them.
## Key Recommendations
### Immediate Actions
1. **Shift Left to "Point of Selection":** Move security gates from the build/CI stage to the developer’s IDE. Packages should be vetted *before* they are imported.
2. **Verify Dependency Existence:** Manually or automatically verify that any package suggested by an LLM actually exists in a public registry (PyPI, npm) before adding it to a `requirements.txt` or `package.json`.
3. **Implement Human Accountability:** Require a human "contributor of record" to take full accountability for every line of AI-generated code and every suggested dependency.
### Short-term Improvements (1-3 months)
1. **Curated Package Repositories:** Establish an internal, "clean" repository of built-from-source components. Block direct developer access to public registries in favor of this curated catalog.
2. **AI Usage Policy Updates:** Explicitly define which AI tools are permitted and set rules for handling AI-suggested third-party libraries.
3. **Enhanced PR Reviews:** Train reviewers to look for "high defect density" in AI-authored code (statistically 70% higher than human code) and "hallucinated" package names.
### Long-term Strategy (3+ months)
1. **Build-Level Attestation:** Implement tools that provide software provenance and verifiable evidence that every component in a build was vetted at intake.
2. **Automated Ingestion Governance:** Integrate automated tooling that blocks the download of packages with known CVEs or those that do not meet internal age/popularity metadata thresholds.
## Implementation Guidance
### For Small Organizations
- **Manual Verification:** Enforce a peer-review checklist that specifically asks: "Did you verify this new dependency exists and is necessary?"
- **Standardize Tools:** Use a single, approved AI assistant to limit the variety of hallucination patterns.
### For Medium Organizations
- **Proxy Registries:** Use a package manager proxy (like Nexus or Artifactory) and configure it to flag or block "new" or "rarely used" packages.
- **SCA Integration:** Move Software Composition Analysis (SCA) alerts into the IDE via plugins so developers see vulnerabilities during the coding phase.
### For Large Enterprises
- **Private Curated Catalogs:** Deploy solutions like ActiveState to provide a "walled garden" of pre-verified, built-from-source packages.
- **Automated Agent Monitoring:** Monitor for "AI agent skills" or automated forks that may be spreading hallucinated dependencies across hundreds of internal repositories.
## Configuration Examples
While specific code for every tool varies, the logic for a "vetted intake" gate follows this flow:
yaml
# Conceptual CI/CD Intake Gate
jobs:
vet-dependencies:
steps:
- name: Check against Curated Catalog
run: |
for package in $(get_new_dependencies); do
check_internal_allowlist $package || exit 1
done
- name: Prevent Slopsquatting
run: |
# Query public API to ensure package isn't brand new
# (common for squatted hallucinations)
verify_package_age_and_metadata $package
## Compliance Alignment
- **NIST SSDF (Secure Software Development Framework):** Aligns with "Produce Well-Secured Software" by vetting third-party components.
- **ISO/IEC 27001:** Supports supplier relationship security and operational security controls.
- **OpenChain (ISO/IEC 5230):** Relates to open-source license and security compliance.
## Common Pitfalls to Avoid
- **Over-reliance on SCA:** Assuming that a "Green" scan post-commit means the code is safe; SCA often misses brand-new malicious packages (slopsquatting).
- **Silent Ingestion:** Allowing CI/CD pipelines to automatically fetch any package found in a configuration file without a human or policy gate.
- **Ignoring Hallucinations:** Assuming that because an LLM is sophisticated, its suggested library names must be real.
## Resources
- **ActiveState Curated Catalog:** [activestate[.]com/curated-catalog]
- **Kusari Application Security Report:** [Resources on application security telemetry]
- **USENIX Security Study:** [Research on code-generation model vulnerabilities]
- **CIS Software Supply Chain Security Guide:** [cisecurity[.]org]