Slopsquatting Exploits AI Hallucinations in Supply Chain Attacks

AI coding assistants are creating a new attack surface

Nearly one in five packages suggested by AI coding assistants don't actually exist — they're hallucinations. Attackers have begun systematically registering these phantom package names on public repositories like npm and PyPI, waiting for developers to install malware disguised as legitimate dependencies.

This emerging threat, called "slopsquatting," represents a dangerous evolution in software supply chain attacks. According to recent research from security company Snyk, 19.7% of generated packages across tested large language models were hallucinated. More concerning: when researchers re-ran 500 prompts that had produced hallucinated package names, 43% returned the same fake packages every single time.

How the attack works

Unlike traditional typosquatting, which relies on developer mistakes, slopsquatting exploits trust in AI recommendations. When a coding assistant suggests a package like "aws-helper-sdk" or "fastapi-middleware" that doesn't exist, attackers can register those exact names at no cost. The packages appear clean because they're new, with no vulnerability history to flag.

"The generator cannot be the validator," Snyk CTO Manoj Nair explained in an interview with Dan Lohrmann. "Asking the model that proposed the package whether it's safe is asking the same system the same question twice."

The attack maps to MITRE framework T1195.001 — Compromise Software Dependencies and Development Tools — entering through the integrated development environment itself. In one disclosed case from July 2024, a model found setup instructions referencing a non-existent PyPI package. An attacker registered the name and published malware under it. Within an hour, 15 real systems executed the malicious code, including a security vendor's scanner that exposed its own credentials.

Why it matters

As companies adopt AI-assisted coding at scale, the human review step is disappearing. In fully agentic pipelines, AI agents resolve dependencies, install packages, and open pull requests without human oversight of individual package names. This automation creates a blind spot attackers can exploit systematically. With roughly 90% of the open-source ecosystem dormant — about 6.3 million abandoned projects — AI models that sample the entire internet may resurrect long-forgotten packages that have never been security-reviewed.

Defending against slopsquatting

Nair recommends automated validation at the point of decision, not manual review queues that slow development. Security checks should run automatically when an AI assistant proposes a dependency, examining maintenance activity, provenance, adoption patterns, and known malicious behavior in milliseconds.

Enforcement should happen at the installation path through proxies that govern package repositories. These can block packages flagged in malware advisories and impose cooling-off periods on new releases — which slopsquatted packages are by definition.

Critically, verification methods that execute code to test it create their own attack surface. Static analysis of packages without running them is essential.

As AI coding assistants become more autonomous, Nair warns the threat will evolve. Attackers may shift from observing hallucinations to inducing them by seeding training data with references to packages they already control. The attack surface extends beyond traditional packages to MCP servers, skills, tools, and configuration files — all name-addressed, all squattable.

The details in this article were first reported by Dan Lohrmann on Government Technology's Lohrmann on Cybersecurity blog, based on research and analysis from Snyk.