I think some folks are very quick to drop rigor and care as "traditional practices" as if we're talking about churning butter by hand. One thing that might be valuable to keep in mind is that LLM tooling might feel like an expert, but generally has the decisionmaking skills of a junior. In that light, the rigor and best practices that were already (hopefully) part of software engineering practice are even more important.

> In traditional development, you review versions carefully. With AI-generated scaffolding, that step is easy to overlook.

If in "traditional development", everything is reviewed carefully, why wouldn't it be when some of the toil is automated? If anything, that's exactly what the time that's freed up by not having to scaffold things by hand should be invested in: sifting through what's been added and the choices made by the LLM to make sure they are sound and follow best practices.

Hi HN — author here.

This incident showed how AI-generated code can inadvertently introduce vulnerabilities. The cryptominer ran because a dependency version chosen by an AI coding agent had a known CVE.

Containarium now runs centralized pentests and vulnerability checks for all applications on the platform to prevent similar attacks.

Curious if others have similar workflows or lessons learned with AI-generated projects.

The attack chain you described highlights a gap that most teams overlook: AI-generated code passes functional tests but skips the "why this version?" review that experienced developers do instinctively.

I think the real issue is visibility. When AI generates a project, every dependency choice is implicit — there's no PR comment explaining why it pinned next@14.1.0 instead of 14.2.1. In a human workflow, someone would have caught that during review.

Two things that have helped in my workflow: 1. Running `npm audit` as a post-generation step before even testing functionality 2. Treating AI-generated commits as "untrusted by default" — reviewing them with the same rigor as external contributor PRs

[dead]