Modern apps are mostly other people's code. A typical AI-built project pulls in hundreds of packages, each with its own dependencies. If an attacker takes over a maintainer account, publishes a malicious update, or slips a fake package into the registry, your next install can bring that code onto your machine and into your product.
AI coding tools raise the exposure because they add dependencies quickly and rarely explain them. They can also suggest packages that do not exist, which attackers can then claim. The same applies to build plugins, GitHub Actions, browser extensions, and any third-party script you load on your pages.
You cannot eliminate the risk, but you can shrink it. Keep the dependency list small, commit a lockfile so installs are repeatable, update on purpose rather than automatically, turn on your platform's vulnerability alerts, and review what a new package does before adding it. Limit the secrets available during builds, and avoid loading third-party scripts on pages that handle logins or payments.