AI-Built Repos Swamp npm With Zero-Cost Abandonware

Open source's supply-chain problem just picked up a structural accelerant. LLMs can generate plausible-looking packages, push them to GitHub and npm, attract real stars and dependents during a brief active window, then go permanently dark at zero marginal cost, with no human ever intending to maintain them. A LeadDev analysis circulating on r/generativeAI puts the mechanism clearly: unlike human-authored abandonware, which accumulated slowly as individual developers moved on, AI repos can be manufactured by the thousands in a single session. The npm ecosystem already hosts packages the security community treats as unmanageable, and that surface is now growing faster than any audit process can track. Essentially: (GitHub, npm) are the blast radius, with no tooling currently capable of distinguishing publish-and-abandon from genuine open-source intent. - AI-generated repos mimic legitimate projects convincingly enough to attract real dependents before going permanently dark. - Zero marginal cost means abandonware accumulation is no longer bounded by developer time or effort. - Each unmaintained package adds a potential supply-chain attack vector in an ecosystem already flagged as unmanageable by security teams. The question for package registries isn't just code quality; it's whether they can function as trusted infrastructure when publication costs hit zero.