From Open Source to OpenAI: The Evolution of Third-Party Risk

From open source libraries to AI-powered coding assistants, the article notes that speed-driven development brings new third-party risks that threat actors are increasingly exploiting. It recalls the SolarWinds breach, a sophisticated supply-chain attack conducted by a Russian advanced persistent threat that pushed a malicious backdoor to 18,000 customers, allowing access to high-value targets.

It also highlights Log4J’s Log4Shell vulnerability as a major, widely exposed supply-chain incident and explains how threat actors have since pursued AI-enabled coding assistants, with hallucinated libraries exploited by registering malicious binaries. The piece introduces “slopsquatting” as the tactic of registering misleading, non-existent packages and notes that organisations can improve visibility through Software Bills of Materials (SBOMs) and security testing such as SAST and DAST.

It cites that, according to GitHub, 97% of developers have used AI tools in the past year, underscoring the need for DevOps to shift left and for cybersecurity to enforce human review and robust prompts and authentication. Written by Nadir Izrael, 16 December 2025.