Skip to content

Back to the catalog

Socket: AI Has Taken Over Open Source
socket.devarticle

Socket: AI Has Taken Over Open Source

Socket analyzes data from its npm/PyPI/Go/Rust package database showing that AI coding tools ("vibe coding") have driven an unprecedented exponential surge in new npm package creation since January 2026, detectable partly via elevated em-dash usage (30%+ vs a 5% human baseline) in README files. The piece also documents maintainers of projects like curl, Godot, Ghostty, and tldraw increasingly rejecting AI-generated pull requests as low-quality spam, and notes degradation in "dependency shopping" signals used to vet packages.

TL;DR Socket's data shows AI-generated packages and PRs are flooding npm and open source maintainers, undermining supply-chain trust signals.
Open original ↗

Organisations named here

  • André Staltz

Technologies named here

  • Socket
  • npm
  • PyPI
  • Socket's package search feature
  • Go
  • Rust
  • react-datepicker
  • curl
  • Godot
  • Ghostty
  • tldraw

Techniques named here

  • AI-generated/automated low-quality pull requests
  • Publication of nefarious/malicious packages at scale
  • Automated dependency selection by AI

Related in Supply Chain