Slopsquatting

Slopsquatting is a software supply chain attack in which criminals register package names that AI coding assistants invent. Large language models sometimes "hallucinate" dependencies — recommending a library that sounds plausible but does not exist. An attacker who publishes a malicious package under exactly that name simply waits: sooner or later a developer will copy the AI's suggestion, run the install command, and pull the attacker's code straight into their project. The term — a blend of "AI slop" and squatting — entered common use in 2025, as research teams measuring popular code models found hallucinated package names in a meaningful share of generated samples, with the same fictional names recurring predictably across sessions.

How it works

Slopsquatting is typosquatting adapted for the AI era. Classic typosquatting preys on human fingers — requets instead of requests; slopsquatting preys on machine imagination, and it is more dangerous for two reasons. First, the hallucinations are repeatable: models tend to invent the same plausible-sounding names again and again, so a squatted name keeps getting recommended to new victims. Second, the victim's guard is down — the name arrived inside working code from a trusted assistant, often alongside perfectly legitimate dependencies, and nothing about it looks mistyped.

The payload follows the standard malicious-package playbook: install scripts that run on download, credential and token stealers aimed at the developer's machine and CI pipeline, or a clean first version followed by a poisoned update. Because developers hold privileged access — source code, signing keys, production secrets — one convenient install can become an organization-wide supply chain attack. Unsanctioned AI tool use makes the exposure harder to see, which is why this risk belongs in any shadow AI conversation.

How to defend against it

• Verify before installing. A ten-second registry check — does the package exist, who publishes it, how old is it, how many downloads — defeats most slopsquatting. Make it a norm for any AI-suggested dependency.
• Pin and review dependencies. Lockfiles, internal registries or proxies with allowlists, and automated dependency scanning catch unknown packages before they reach builds.
• Train developers specifically. Security awareness for engineering teams should name this pattern: AI output is a draft, and dependencies are the one part you never accept on faith.
• Monitor the pipeline. Alert on first-use packages and on install-time script execution in CI.