Analysis
Slopsquatting turns AI-hallucinated packages into attacks
Publication date unknown · Discovered netwrix.com
Page published
Publication date unknown · First observed: 27 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Slopsquatting can turn AI-generated dependency recommendations into developer-machine compromise, and checking whether a package exists is insufficient once an attacker has registered it.
Slopsquatting exploits package names hallucinated by AI coding assistants: attackers can register those names and publish malicious packages that developers may install. The Netwrix explainer cites a 16-model study finding that 19.7% of recommended packages did not exist and that many invented names recurred across repeated prompts.