A look at “slopsquatting”, a supply chain attack where threat actors make malicious packages on indexes using AI-hallucinated names resembling popular libraries
Good morning. Arguments start today … arXiv : We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs arXiv.org e-Print archive : We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs Bluesky: Laurie Voss / @seldo.com : Every time I read about a novel supply chain attack on npm - which is like every week - I thank the stars it's not my job anymore. www.bleepingcomputer.com/news/ securit... @spavel : Can vibe coding increase velocity? — Yes, in fact it speeds up the entire product lifecycle, from first deployment to embarrassing hack that steals all your customers' money and leads to the company being shut down for gross negligence. Ally Tibbitt / @allytibbitt.me : “What a world we live in: AI hallucinated packages are validated and rubber-stamped by another AI that is too eager to be helpful.” — www.theregister.com/AMP/2025/04/ ... Andrey Sitnik / @en.sitnik.ru : Attacks on vibe-coding have begun. LLMs sometimes hallucinate and install non-existent packages. — As a result, attackers have started publishing malicious packages under these hallucinated names, which frequently appear in AI-generated suggestions. — socket.dev/blog/slopsqu... [image] Seth Michael Larson / @sethmlarson.dev : Do I have to add “coined slopsquatting” to my resume now? 🤣 Forums: r/technology : LLMs can't stop making up software dependencies and sabotaging everything r/netsec : We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs r/programming : AI code suggestions sabotage software supply chain See also Mediagazer
Context & Ripple Effects
Package-name confusion was already a supply-chain weakness: dependency-confusion attacks showed how public registries can redirect software resolution away from intended internal or local packages. Slopsquatting adapts that logic to a new input source—code-generating models that recommend dependencies that do not exist.
The risk is not merely theoretical: a prior demonstration found that a package using a ChatGPT-hallucinated name accumulated downloads and appeared in repositories, while AI-assisted development has also created maintenance noise from low-quality model output.
First-order effects
- Developers who copy model-generated dependency suggestions can install attacker-controlled code when a hallucinated name has been registered on a package index.
- Package maintainers and registry operators face a new class of suspicious packages whose names are selected to match model errors rather than only typos or known brands.
Second-order effects
- Security teams will need to treat AI-generated dependency lists as untrusted input, adding package verification and provenance checks to AI-assisted coding workflows.
- Attackers gain a scalable way to target popular coding prompts and library ecosystems; the later npm maintainer compromise affecting 18 packages illustrates the broader exposure created when malicious code reaches trusted distribution channels.
Third-order effects
- If code assistants remain part of dependency selection, software supply-chain security will increasingly depend on whether models, registries, and development tools can validate package existence and ownership before installation.
- The pattern broadens the attack surface from compromised maintainers and naming collisions to model-mediated recommendations, making assurance of AI-generated code a durable ecosystem concern.
The trend: Slopsquatting is part of the shift toward AI-assisted development becoming both a productivity layer and a new software supply-chain trust boundary.