Slopsquatting: AI Hallucinations Fuel New Software Supply Chain Threat

A new threat to developers, dubbed slopsquatting, stems from the behavior of large language models (LLMs) used in AI coding assistants. These models occasionally generate plausible but nonexistent software package names, which attackers register and fill with malicious code. This code then infiltrates developer projects through AI recommendations.

Unlike traditional typosquatting—where attackers exploit typos in popular library names (e.g., “crossenv” instead of “cross-env”)—slopsquatting relies entirely on fabricated names. This makes the attack harder to detect, as security systems fail to flag such packages as threats. For example, a registry may block a package with a typo, but miss names like “mpn install cross-env file” or “cross-env-extended.”

Research shows open-source vulnerabilities are growing at 98% annually, with their average lifespan increasing by 85%. This means malicious packages can evade detection in production environments for months or even years. Developers using open-source LLMs are particularly vulnerable, as these models generate fake packages four times more often than proprietary ones. For instance, GPT-4.0 Turbo has a hallucination rate of 3.59%, while the open-source model DeepSeek 1B reaches 13.63%.

To mitigate risks, experts advise developers to verify all AI-recommended packages in official registries before implementation. Automated checks and monitoring for unusual package installations also help detect potential threats early. Additionally, staying updated on emerging slopsquatting campaigns and threat intelligence is critical.