slopsquatting

A software supply-chain attack that turns invented dependencies into a trap: code-generating language modelslarge language model, n.: A computer program trained on enormous amounts of text to predict the words that come next. At vast scale, that simple skill lets it chat, answer questions, translate, summarize and write code. often hallucinatehallucination, n.: When an AI states something false or made up — a fake fact, quotation or source — fluently and confidently, as if it were true. plausible package names, and an attacker who claims one of them on a public registry such as PyPI or npm hands attacker-controlled code to any developer or coding agentcoding agent, n.: An AI agent that writes and fixes software by itself: it reads a codebase, edits files, runs commands and tests, and keeps working until a feature is built or a bug is fixed. that installs the suggestion. It works because package hallucinations are common and often recur for similar prompts, making the names predictable: a 2025 study found that about 20% of packages recommended in generated code did not exist, with open models hallucinating far more often than commercial ones. It is a cousin of typosquatting, which relies on human typing errors. Defenses include checking that suggested packages exist and are reputable before installing them, dependency allow-lists and lockfiles, registry monitoring of newly claimed names, and grounding coding agents in real package indexes.

The agent proposed a dependency nobody had heard of — a textbook slopsquatting risk — so CI blocked the install.