Slopsquatting Explained: When AI Hallucinates a Package Name

Slopsquatting is one of the newest supply-chain attacks, and it exists entirely because of AI coding. Here's the short version: large language models sometimes invent package names that sound completely plausible but don't actually exist. Attackers noticed this, started registering those hallucinated names as real packages full of malicious code, and now wait for developers to install them on an AI's confident recommendation. The name is a play on "typosquatting," but the mistake isn't a typo — it's AI "slop" that a human trusted.

How slopsquatting works, step by step

The attack chains together one AI weakness and one human habit:

1. You ask an AI assistant how to do something, and it suggests installing a package — say, fast-secure-auth — that sounds perfect for the job.
2. That package doesn't exist. The model hallucinated it. But it sounds so reasonable that you (or the next thousand developers who get the same suggestion) don't question it.
3. An attacker, who has been cataloguing the names LLMs commonly hallucinate, has already registered fast-secure-auth on the package registry — with malicious code inside.
4. You run the install command. The malicious package now runs with your project's permissions: it can steal environment variables, exfiltrate secrets, or open a backdoor.

The unsettling part is step 2 and 3: because models are deterministic enough to hallucinate the same fake names repeatedly, an attacker can pre-register them and simply wait.

Why AI makes this attack possible

Traditional typosquatting needs you to fumble a keystroke. Slopsquatting doesn't — the AI makes the "mistake" for you and presents it with total confidence. Language models are built to produce plausible text, not verified facts, so a package name that fits the pattern of real names is exactly the kind of thing they'll generate whether or not it exists. When you can't easily tell a real dependency from an invented one, confidence becomes a liability.

How to protect yourself from slopsquatting

Never install a package just because an AI suggested it

Treat every AI-recommended dependency as unverified. Before installing, confirm the package exists on the official registry and look at the signals a fake package can't easily fake: download counts, publish history, a real linked repository, and a maintainer with a track record. A "perfect" package with 40 downloads and a publish date of last week deserves suspicion.

Pin and review your dependencies

Use a lockfile and pin versions so a dependency can't silently change under you, and review your lockfile when it changes. If a package name appears that you don't recognize or didn't deliberately add, stop and investigate before shipping.

Scan your code for suspicious dependencies

A code scan can flag unknown or suspicious packages before they reach production, which is especially valuable when you're building fast with AI and can't manually vet every suggestion. This is part of the same problem as the rest of AI-generated code vulnerabilities: the tool is confident, and confidence isn't correctness.

The takeaway

Slopsquatting turns an AI's hallucination into your security incident. The defense is a habit, not a product: verify every dependency an AI recommends against the official registry before you install it. And because AI-built apps carry plenty of other predictable gaps, run a broader check too — paste your live URL into Sayver's free website security scan to catch the exposed keys, missing controls, and misconfigurations that so often ship alongside a rushed dependency.