Slopsquatting targets AI-powered development workflows, weaponizing model hallucinations. This concept, coined by Seth Larson and popularized by Andrew Nesbitt in 2025, represents a significant evolution in supply chain attacks.
It fundamentally differs from traditional typosquatting, which relies on human error. Typosquatting bets on a developer mistyping express as expres. Slopsquatting, however, bets on the AI assistant confidently inventing a package name that doesn't exist, like requests-oauth2-helper. The developer then faithfully copies this invented name.
This seemingly small shift has a nasty consequence. The mistake isn't a human typo; it's an AI hallucination upstream, which the human then reproduces. The attacker doesn't guess what your fingers might slip into. They read what the model actually outputs, at scale, and register the most common hallucinated names.
Here's what makes Slopsquatting a unique and potent threat:
- Frequency of Hallucinations: A USENIX Security 2025 study extensively analyzed 576,000 code samples across 16 LLMs in Python and JavaScript. A significant 19.7% of all recommended packages simply did not exist. This amounted to 205,474 distinct hallucinated package names. This isn't an edge case; it's a fundamental behavior.
- Reproducibility: If every hallucination was a unique snowflake, this threat would be manageable. However, the study found hallucinations are highly reproducible. When 500 prompts that produced fake packages were run ten more times each, 43% of those hallucinated packages reappeared every single time. A total of 58% showed up in more than one run. This means the model tells attackers exactly which fake names a future developer is most likely to be handed.
- Bypassing Traditional Defenses: Using Levenshtein distance, the study found only 13% of hallucinated names were simple typos of real ones. Nearly half were highly dissimilar, fully fabricated but believable within the code context. This bypasses common typo-based detection mechanisms.
The real-world kill chain is alarmingly straightforward. An AI assistant suggests an invented package that sounds perfectly legitimate for the problem at hand. The developer, trusting the AI's output, copies the name and runs an install command. On platforms like npm and pip, installing a package can automatically execute malicious code via postinstall hooks or setup.py build steps, without the need for further interaction.
In simple terms, Slopsquatting is a supply chain attack where the AI assistant inadvertently performs target selection and reconnaissance for the attacker, confidently suggesting non-existent but plausible packages that can then be weaponized. It represents a fundamental shift from relying on human error to leveraging predictable machine error.
My journey exploring agentic architectures consistently highlights that software is moving in this direction. This attack underscores that alignment and safety are not afterthoughts; they are engineering concerns. Building beats consuming, and understanding vulnerabilities like Slopsquatting is crucial. It’s how we contribute to a more secure AI ecosystem, pushing the boundaries responsibly. Adaptability in our defense strategies is no longer optional; it's essential for the future of AI.
Top comments (0)