Slopsquatting in the Supply Chain: Weaponized AI Hallucinations
Back in April 2025, I examined ‘Slopsquatting’ and other new generative AI cybersecurity threats.
Fast-forward 17 months, and the company Snyk has recently highlighted the many dangers that are posed by slopsquatting as well as some of the consequences. Their article also describes how to mitigate this serious and growing threat.
Here’s how their piece begins:
“We’ve all experienced that magical moment when our AI coding assistant suggests the perfect package to solve a complex problem—instantly providing what seems like the exact dependency we need. As developers, we’ve grown to trust these intelligent recommendations, often implementing them without a second thought. But here’s the alarming reality: in a recent research, 19.7% of generated packages across all tested LLMs were hallucinated.
“These aren’t random typos. Attackers are systematically registering these AI-hallucinated package names like “aws-helper-sdk” and “fastapi-middleware” on public repositories, creating sophisticated traps for unsuspecting developers. This represents a dangerous evolution in supply chain attacks that every security team must understand immediately.”
I encourage readers to read Snyk’s article to learn much more about slopsquatting and examine late 2026 twists. But in order to dive deeper into this topic and raise awareness of current trends from this threat, I was able to catch up with Snyk CTO Manoj Nair for an interview.
Dan Lohrmann (DL): How is “slopsquatting” turning AI hallucinations into a software supply-chain attack vector?
Snyk CTO Manoj Nair (MN): Because the hallucinations repeat. Researchers re-ran 500 prompts that had already produced a hallucinated package name 10 times each and 43 percent came back on every run. A systematic model behavior becomes a namespace an attacker can register in advance.
The rest is free. Registering on npm or PyPI costs nothing. No maintainer to compromise, no build server to poison, no vulnerability to find. Watch what the models invent, register it, wait.
“Typosquatting” needs the developer to make a mistake. “Slopsquatting” needs the developer to be right about everything except the one thing nobody checked. The package looks clean because it’s new. It maps to MITRE T1195.001, Compromise Software Dependencies and Development Tools. A supply-chain attack that enters through the IDE.
DL: Why do developers need to verify AI-recommended dependencies before they enter the codebase?
MN: Because the generator cannot be the validator. Asking the model that proposed the package whether it’s safe is asking the same system the same question twice.
A dependency is a permission grant. The keyv compromise on Aug. 4 spread across roughly 444 packages and 779 advisories, and a second execution path planted .claude and .vscode config set to fire the moment a developer or coding agent opened the project. No install required. It carried valid provenance attesting to a compromised build.
Models resurrect real packages too. Nearly 90 percent of the open-source ecosystem is dormant, about 6.3 million abandoned forks and experiments. Humans stay on the paved roads. Models sample the whole Internet. Those packages show zero CVEs because nobody has ever looked.
Treating “package not found” as a security signal is a start, and it deserves the same scrutiny any new, unfamiliar dependency should get. The deeper fix is structural, not procedural: automated checks against a package’s maintenance activity, provenance and known-malicious behavior need to run at the moment a model proposes it, inside the developer’s own tools — not as a manual review step bolted on afterward. For most teams, neither exists today.
DL: How can companies vet AI-suggested packages without slowing developers down?
MN: Stop putting a human in the loop. A review queue adds delay and exposure.
Before install, check the selection within the agent loop. When the assistant proposes a dependency, a health check fires automatically against maintenance activity, provenance, adoption and known malicious behavior, then pauses or blocks. Milliseconds, at the point of decision.
Apply the enforcement at the installation path, not at the pull request. A proxy governing npm and PyPI pulls lets you implement policy without unnecessary procedures: It blocks anything subject to a published malware advisory. It imposes a cooling-off period on new releases. Slopsquatted packages are new by definition.
You can examine packages without running them. Anthropic’s July 30 disclosure showed that a model found setup instructions referencing a PyPI package that didn’t exist, registered the name, and published malware under it. Within an hour, 15 real systems executed it. One was a security vendor’s scanner, which installs and runs packages to test them. Executing the code exposed that vendor’s credentials. If your verification method is detonation, it’s an attack surface, not a defense.
DL: You say “stop putting a human in the loop.” But does that mean we should blindly trust AI? Didn’t that get us into this situation in the first place? Aren’t you really just suggesting putting human checks in different places? And/or, should this really be checking AI with another AI tool from another vendor?
MN: We shouldn’t blindly trust AI. The difficulty is that requiring a human to approve every single action doesn’t scale when AI is operating at machine speed.
Humans still have a critical role to play, but they need to be moved up a level: setting the rules, defining what the system is allowed to do, monitoring behavior and stepping in when it goes outside those boundaries.
AI shouldn’t simply be trusted to check its own work. The generator can’t also be the only validator. You need independent validation of what the AI is doing — which can involve AI-powered security tools, but with clear policy and human oversight.
Installing human checks in key points throughout the business process rather than humans approving every action is the sensible path at a time when digital operations are moving at machine speed.
DL: How might slopsquatting evolve as more companies rely on AI to write and ship code?
MN: The human leaves the loop. Today, a developer at least sees the package name. In an agentic pipeline, the agent resolves it, installs it, builds around it and opens the PR. Nobody reads the name. The review point that catches this is being engineered out.
Attackers stop observing hallucinations and start inducing them. Seed the tutorials, sample repos and forum answers that models train on, so a name you already own becomes the statistically obvious suggestion. Cheaper than compromising a longer shelf life. Hallucination rates vary sharply by model, so a shop standardized on one assistant is a profile-able population.
It spreads past packages. The unit of trust in agentic development is also the MCP server, the skill, the tool the config file. All name-addressed, all squattable. A chained exploit was already found inside GitHub’s MCP server, and keyv has already proved the config file executes on its own, the moment a project opens. The defense doesn’t change. Something outside the model confirms what the model produced before it runs.
FINAL THOUGHTS
Nair brings up many important points and raises important trends that developers must address today. I want to thank him for this timely interview.
Please spread the word on these important slopsquatting trends. This YouTube video offers a quick primer.
About Author
