Slopsquatting is an emerging security threat fueled by AI coding assistants producing hallucinations—fake software package names that attackers can register with malicious code. Unlike traditional typosquatting, where misspelled packages are targeted, slopsquatting exploits AI-generated fictitious package names that seem plausible, making detection difficult. When developers unknowingly incorporate these fake packages, malware can be injected directly into their codebases.
This new risk arises because large language models (LLMs) tend to generate the most statistically likely output rather than verifying accuracy, resulting in frequent hallucinations. Proprietary AI models show lower hallucination rates compared to open-source ones, but no system is immune. As AI-assisted coding grows more common—with many developers integrating AI into their daily workflows—the risk surface for slopsquatting expands.
To reduce risk, developers should verify package existence against official repositories, and organizations must deploy automated checks and threat intelligence to catch malicious packages early. This evolving threat underscores the importance of vigilance and security measures in AI-supported software development.
— Zac Amos, Features Editor at ReHack
