Slopsquatting is a software supply-chain attack that exploits package names hallucinated by AI coding assistants. An attacker registers a plausible but previously nonexistent package name, then waits for a developer or agent to install the package after an LLM suggests it.
The attack is related to typosquatting, but the source of the name is different. Typosquatting targets human typing mistakes. Slopsquatting targets model-generated dependency suggestions that look legitimate but were never part of the real ecosystem.
The risk increases when an AI agent can run package-manager commands, edit dependency manifests, or execute generated code with limited human review. It also affects ordinary copy-paste workflows from chat interfaces.
Mitigations include:
- verifying package existence, ownership, age, and download history before installation;
- pinning dependencies from trusted registries;
- blocking package installs in an agent sandbox unless approved;
- using lockfiles and software composition analysis;
- preferring official documentation over model-suggested package names; and
- treating dependency additions as consequential actions in agent policy.
Endor Labs describes slopsquatting as a supply-chain attack where AI agents hallucinate package names that attackers can register in Slopsquatting: When AI Agents Hallucinate Malicious Packages.
The LLM Knowledge Base is a collection of bite-sized explanations for commonly used terms and abbreviations related to Large Language Models and Generative AI.
It's an educational resource that helps you stay up-to-date with the latest developments in AI research and its applications.