Skip to content

Back to the catalog

AI-Generated Malware and the Software Supply Chain | Blog | Endor Labs
endorlabs.comarticle

AI-Generated Malware and the Software Supply Chain | Blog | Endor Labs

Endor Labs analysis of how generative AI is reshaping software supply chain attacks: lowering the skill barrier via tools like WormGPT/FraudGPT, enabling faster AI-generated variant/polymorphic malware, scaling malicious package generation (including slopsquatting from LLM package-name hallucinations), and improving phishing for maintainer account takeover. Cites a 14x increase in malware advisories over two years and that 92% of npm account takeovers led to malware distribution, referencing the open-sourced Shai-hulud npm worm. Recommends behavior-based detection before install, dependency/package firewalls, CI/CD hardening against credential-harvesting postinstall scripts, and dependency governance.

TL;DR Endor Labs breaks down how AI lowers cost/raises speed of existing supply-chain attacks (malicious packages, polymorphic malware, phishing) with npm data and defensive recommendations.
Open original ↗

Organisations named here

  • Shai-Hulud
  • slopsquatting

Technologies named here

  • Endor Labs package firewall
  • npm
  • Endor Labs multi-agent malware detection system
  • PyPI
  • Mythos
  • GPT-5.5-Cyber

Techniques named here

  • AI-assisted payload writing
  • AI-assisted polymorphism / variant mutation
  • Malicious package generation at scale / slopsquatting
  • LLM-crafted phishing / context-aware lures
  • Maintainer account takeover
  • Post-install script credential theft

Threat actors named here

  • WormGPT
  • FraudGPT
  • Shai-Hulud worm

Related in Supply Chain