The Supply Chain Is the Product Now: Who Poisons the Well?

The code writes itself. The poison does too.

Right now, as I write this from Jönköping on a grey Friday morning, two separate attackers have successfully poisoned popular open source tools. Not obscure libraries nobody uses. Popular ones. The same week, North Korean state hackers hijacked the Axios npm package to distribute malware. Axios. The HTTP client that sits in roughly every Node.js project shipped in the last eight years.

And the industry response? A few tweets. A CVE number. Maybe a Hacker News thread that cycles off the front page by Monday.

Meanwhile, every AI coding agent on the planet is pulling from these same dependency trees. Every vibe-coded MVP, every rapid prototype, every "ship it Friday" feature sprint. The AI doesn't know the well is poisoned. It just drinks.

This is the thing nobody wants to talk about: we have made AI agent development the center of modern software. Agents write code, suggest dependencies, wire up integrations. And the supply chain those agents pull from is a warzone that nobody is defending.

The math that should scare you

Here is how this works. A coding agent generates a solution. It selects packages based on training data, popularity signals, and pattern matching. It does not audit the maintainer's commit history. It does not check if the package was transferred to a new owner last Tuesday. It does not notice that a build script now phones home to a server in Pyongyang.

The attack surface has not grown linearly. It has gone exponential. And here is why.

When a human developer picks a dependency, there is at least a chance they notice something off. They might check the repo. They might read the changelog. They might know the maintainer's name. An AI agent does none of this. It optimizes for function, not provenance.

According to The Register's reporting this week, the two separate poisoning attacks used different techniques but shared one thing: they targeted the trust layer. They compromised packages that other packages depend on. Transitive dependencies. The ones humans never look at and AI agents never question.

Now multiply this by the fact that AI-generated code is becoming the majority of new code in many organizations. GitHub's own data points this direction. The repos trending right now tell the story: opencode (153k stars, an open source coding agent), everything-claude-code (171k stars, agent performance optimization), and system-prompts-and-models-of-ai-tools (136k stars, exposing how every major coding AI actually works internally). The entire ecosystem is accelerating toward agent-written code. The dependency graph is getting wider and deeper. And the security model is stuck in 2019.

Sweden and the Nordic position: better than we think, worse than we need

From here in Jönköping, I see something interesting happening. Swedish software development culture has always been more cautious than Silicon Valley. We tend to over-engineer. We test more. We ship slower. For years this felt like a disadvantage. Right now it might be the only reason some Swedish companies are not already compromised.

But caution is not a strategy. It is a habit. And habits break under pressure.

The pressure is real. Every tech company in Jönköping, Stockholm, Gothenburg, and Malmö is racing to integrate AI into development workflows. The competitive pressure to ship faster, to use agents, to automate everything is identical to what teams in San Francisco face. The difference is we are doing it with smaller teams and thinner margins, which means less room for dedicated security review.

Here is what Sweden gets right: the engineering culture values understanding your tools. Swedish developers read documentation. They question defaults. This matters more now than it ever has, because the defaults are being set by AI agents that have no concept of trust.

Here is what Sweden gets wrong: we assume the EU will handle it. We wait for regulation. We comply instead of lead.

The EU's accidental defense architecture

And yet. The EU might actually be doing something useful here, almost by accident.

Perforce's 2026 State of Open Source report, released this week, highlights a decisive EU shift toward digital autonomy. The Cyber Resilience Act. The push for software bills of materials (SBOMs). The emerging requirement that companies know, actually know, what is in their software.

In the US, this conversation stalled. The executive order cycle resets every administration. CISA does good work but has no teeth. The market optimizes for speed and nobody wants to slow down to audit a dependency tree.

In the EU, the regulatory apparatus is slow and bureaucratic and sometimes infuriating. But it is producing something nobody else has: a legal framework that forces companies to take supply chain integrity seriously. Not as a best practice. Not as a nice-to-have. As a compliance requirement with real consequences.

This is not the same as saying the EU is doing it well. The implementation is messy. The timelines are unclear. Small companies are going to get crushed by compliance costs if nobody builds decent tooling. But the direction is right.

And Swedish companies are sitting at the center of this. We are EU members with strong engineering talent and deep open source roots. We should be building the tools that make this compliance possible. Instead, most Swedish tech companies are treating the Cyber Resilience Act as a future problem.

It is a present problem. This week proved it.

What the AI-written codebase actually needs

Let me be concrete about what I think is required. At HEIMLANDR.IO, when we build AI agents or ship rapid MVPs, we treat the dependency graph as part of the product. Not an afterthought. Part of the product.

This means:

1. Dependency provenance tracking. Every package that enters a build must have a verified source. Not just "it's on npm." Who maintains it? When did ownership last change? Is the build reproducible? If an AI agent suggests a package, a human reviews the provenance before it ships.

2. SBOM generation on every build. This is already moving toward being a legal requirement in the EU. Get ahead of it. Generate software bills of materials automatically. Make them part of your CI pipeline today, not when the regulation forces you.

3. Pinning and lockfile discipline. This sounds basic. It is basic. And I still see teams letting AI agents update dependencies without lockfile review. Stop it.

4. Agent output review as a security function. Code review is not just about logic anymore. When an AI writes code, the review process must include dependency analysis. What did the agent pull in? Why? Is there an alternative with a more trustworthy maintenance history?

5. Transitive dependency monitoring. The attacks this week were not on direct dependencies. They were on dependencies of dependencies. You need tooling that watches the entire tree, not just the top level.

Where this goes: 2027 and beyond

Let me sketch the trajectory I see.

By 2027, AI agents will write 70-80% of new application code in many organizations. The agents will be better. The code will be better. And the attack surface will be enormous.

State actors are already targeting this. North Korea is not experimenting. They are operationalizing supply chain attacks as a revenue and espionage channel. China and Russia have similar capabilities. The incentive structure is perfect: poison one popular package, compromise thousands of companies simultaneously.

As we move toward more capable AI systems, the agents themselves become attack vectors. An agent that can write code can be manipulated into writing compromised code. Prompt injection is already a known attack. Combine prompt injection with supply chain poisoning and you get a self-reinforcing attack loop: poisoned packages that teach the agent to trust more poisoned packages.

The defense has to be structural, not behavioral. You cannot rely on individual developers or even individual companies to catch this. You need infrastructure-level solutions. Verified package registries. Cryptographic signing of the entire dependency chain. AI agents that are trained on security provenance, not just functionality.

The EU's digital autonomy push, clumsy as it is, points in the right direction. The question is whether it moves fast enough. My bet: it does not, and the gap gets filled by private tooling. Which means there is a massive opportunity for companies that build supply chain security infrastructure.

Swedish companies should be all over this. We have the engineering depth. We have the regulatory proximity. We have the cultural tendency to care about things being done properly. What we lack is urgency.

What to look at

If you are a CTO or senior engineer and this piece is making you uncomfortable, good. Here is where to start:

n8n (186k stars). Fair-code workflow automation with native AI capabilities. Relevant here because it is self-hostable. When your automation platform runs on your infrastructure, you control the supply chain. Compare this to SaaS-only alternatives where you have zero visibility into what they are pulling in.

opencode (153k stars). An open source coding agent. The value here is transparency. You can audit what the agent does, what it pulls in, how it makes dependency decisions. Closed-source coding agents are black boxes. In a supply chain attack scenario, black boxes are liabilities.

Sigstore and SLSA frameworks. If you are not already looking at software supply chain attestation frameworks, start now. These are the building blocks for the kind of cryptographic dependency verification that the post-AI codebase will require.

The EU Cyber Resilience Act text itself. Read it. Not a summary. Not a blog post about it. The actual regulation. If you ship software in the EU, this is your future. Knowing it now is a competitive advantage.

The well is not going to guard itself

I started this piece talking about poisoned wells. Let me end there.

Open source is the shared water supply of the entire software industry. It is magnificent. I have built my career on it. We build on it every day at HEIMLANDR. But shared resources require shared stewardship, and right now the stewardship model is broken. A handful of underfunded maintainers are the last line of defense against state-sponsored attackers, and we just added AI agents that drink from the well at a thousand times the rate humans ever did.

If you are a founder or CTO, this is your problem. Not your security team's problem. Not your DevOps team's problem. Yours. Because when the supply chain is compromised, the product is compromised. And the product is your company.

From Jönköping, the view is clear. The code writes itself now. The question is whether we are going to let the poison write itself too.

Fredrik Brunnberg is the CEO of HEIMLANDR.IO, building AI and software solutions from Jönköping, Sweden. This is the daily HEIMLANDR briefing. If you found this valuable, share it with someone who builds things.