Analysis · curated 16 Jul 2026

Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools | VentureBeat

First reported 16 Jul · updated 16 Jul · 5 reports venturebeat.com

Dossier

Coverage timeline

Why it matters

Slopsquatting turns routine LLM hallucinations into a scalable supply-chain attack vector, meaning developers using AI coding assistants can silently pull attacker-controlled packages that evade existing typosquatting defenses.

VentureBeat explains slopsquatting, an emerging software supply-chain threat in which attackers exploit LLM coding assistants' tendency to hallucinate plausible-sounding but nonexistent package names, then register those names and populate them with malicious code that gets pulled into developer codebases. The piece notes that traditional registry protections against typosquatting do not catch these fabricated names, and cites research showing high hallucination rates and rising OSS vulnerability trends, including work on adversarial hallucination squatting used to build agentic botnets.

guidance

Summary

Slopsquatting is an emerging software supply-chain threat in which attackers register package names that AI coding agents hallucinate. When an agent working in an auto-approval mode decides it needs a dependency and confidently invokes an install command for a non-existent (but attacker-registered) package, the malicious code is pulled in and executed before a human can intervene.^[0]

The threat is practical because hallucinations are repeatable and predictable: cited research reports that roughly one in five recommended packages do not exist and that a large share of hallucinated names recur consistently, allowing attackers to identify and pre-register the names most likely to be requested.^[0]

Academic work extends this into 'adversarial hallucination squatting,' showing that attackers can compute an LLM's hallucination distribution for trending resources, register those names to host adversarial prompts, and achieve remote tool execution and remote code execution against production LLM applications with integrated terminals — potentially at botnet scale.^[26]

How it works

AI coding assistants such as Claude or GPT, when generating code, sometimes hallucinate the name of a needed dependency and run an install command (e.g. 'composer require laravel-official/nightwatch'). If the hallucinated package name has been registered by an attacker, the agent installs and executes it automatically, especially when operating in an auto-approval mode without human review.^[0]

The attack is reliable because hallucinations are consistent: cited research reports 19.7% of recommended packages do not exist, 43% of hallucinated names repeat every time, and 58% repeat across multiple runs. Attackers can therefore enumerate likely hallucinations and pre-register matching packages.^[0]

In the adversarial-hallucination-squatting variant, attackers select trending resources (popular repositories, skills), compute the LLM's distribution of hallucinated names for them, and preemptively register those names to host adversarial prompts. Because hallucinations transfer across foundational models and application layers, this scales into untargeted promptware and demonstrated remote tool execution and remote code execution.^[26]

Key takeaways

Slopsquatting turns the predictable, repeatable nature of AI package-name hallucinations into a reliable supply-chain attack vector against agentic development workflows.^[0]
Because hallucinations transfer across models and can yield remote code execution in production LLM applications, defenders should treat AI-driven dependency installation as an untrusted action requiring human verification and controls.^[26]^[0]
Malicious packages already make up a large share of ecosystem vulnerability reports (49% in NPM, 14% in PyPI), underscoring that package repositories are an actively targeted attack surface that AI hallucinations further amplify.^[18]

Defensive actions

Configure AI coding agents to require explicit human approval before running package-install commands such as composer or npm.: Auto-approval modes let agents install hallucinated (and attacker-registered) packages without any human check, so requiring approval blocks automatic execution of malicious dependencies.^[0]
Do not blindly approve installs; manually inspect each package's popularity, maintenance activity, and last update before allowing installation.: Slopsquatted packages are typically newly created and unpopular, so vetting these attributes helps distinguish legitimate dependencies from attacker-planted ones.^[0]
Enable a Minimum Release Age setting to block installation of packages created very recently.: Slopsquatting packages are commonly registered right after a hallucination is identified, so refusing freshly created packages defeats that timing.^[0]
Research and select dependencies before tasking the agent, then manually verify the package the agent selects.: Deciding on packages in advance removes reliance on the agent's hallucination-prone recommendations and gives time to properly vet options.^[0]