Last month, a threat actor published nearly 800 malicious npm packages in a 48-hour window — a campaign researchers are tracking as "Flooding Dropper." The packages didn't impersonate real libraries. They used names that just sounded plausible, the exact pattern you'd expect if an AI model had suggested them.
That's not a coincidence. It's a documented attack class called slopsquatting.
What's actually happening
When you ask an AI coding assistant for a dependency, it sometimes recommends a package that doesn't exist. A 2025 USENIX Security study generated over 2 million code samples across 16 popular models and found that 19.7% of them referenced at least one hallucinated package — open-source models hallucinated at nearly 22%, commercial models at just over 5%.
The dangerous part: these hallucinations aren't random. 43% of fabricated names reappear every time you ask the same question. An attacker doesn't need to guess — they can query the same models researchers did, get the same list, and register those exact names on npm or PyPI before anyone else does. Then they wait.
It's already worked. A hallucinated PyPI package called huggingface-cli picked up 30,000+ downloads before anyone caught it. A malicious npm package named react-codeshift spread through 237 real repositories.
Why this hits vibe coders hardest
If you're building with Lovable, Bolt, Base44, or similar tools, you're not just accepting AI-written logic — you're accepting AI-recommended dependencies, often without ever seeing a terminal. Most non-technical builders have no way to tell a real package from a plausible-sounding fake one. That's exactly the gap slopsquatting is designed to exploit.
What you can do about it right now
We just shipped a free check for this in TrustBoost's MCP server (the same tool we built to catch missing Supabase RLS policies — see our [earlier post] if you missed it). It checks your package.json against the live npm registry and Google's OSV.dev vulnerability database — no static list to go stale, no API key needed. Connect it in Claude Code or Cursor at api.trustboost.dev/mcp/scan, or run the same RLS/service_role check we always offered at api.trustboost.dev/free-scan.
Top comments (0)