Analysis · curated 23 Aug 2026
What is 'SlopSquatting'?
First reported youtube.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Slopsquatting turns predictable AI package hallucinations into a viable software supply-chain attack vector, so developers relying on AI-generated code recommendations must verify package legitimacy before installing.
In a one-minute video, Tanya Janca (SheHacksPurple) defines 'slopsquatting,' where an AI coding assistant hallucinates the name of a non-existent software package and a malicious actor then registers that name and publishes harmful code under it. Developers who trust the AI's recommendation download the malicious package, turning a hallucination into a software supply-chain attack.