Post

I feel the need to add the nuance that obviously a project being open source doesn’t mean you’ll know it’s vibe coded. Someone could run a local LLM and push the code themselves. But a lot of prompt “engineers” won’t use any method to obfuscate the LLM contributions, so they’re low hanging fruit.

"I used the AI to analyze the AI."

Already happening on npm and PyPI: packages that look AI-scaffolded but ship a payload in a postinstall script. Nobody reviews a dependency diff the way they'd review a PR.

This is already happening with npm and PyPI. A slick README and a few stars get a package installed before anyone reads the code, AI-written or not.

Fair warning. Nobody's auditing dependency chains when the README says 'built with AI' and stars roll in fast. That trust shortcut is exactly what malware authors are exploiting right now.