Slopsquatting
Attackers publish malicious packages with names that LLMs hallucinate. huggingface-cli, react-codeshift. In your FA practice, this looks like an AI suggesting a library that doesn't exist, which you then install—unknowingly pulling in a malicious payload.
Slopsquatting is a supply-chain attack vector where threat actors monitor LLM hallucinations to identify non-existent package names frequently suggested by AI models. By registering these phantom packages on public repositories like npm or PyPI, attackers bait developers into installing malicious code under the guise of legitimate AI-recommended dependencies.
Slopsquatting is a targeted software supply-chain compromise leveraging LLM-induced hallucination to facilitate dependency confusion or typosquatting. Adversaries perform reconnaissance on LLM output patterns to identify high-probability hallucinated package identifiers, subsequently registering these namespaces with malicious payloads to exploit the trust-based execution flow of developers integrating AI-generated code snippets.
evolution
- 2023-05 · historyInitial conceptualization
Security researchers began identifying the risk of LLMs hallucinating non-existent software packages that attackers could register to execute supply chain attacks.
- 2023-09 · historyProof of concept demonstration
Researchers demonstrated 'AI Package Hallucination' by successfully registering packages suggested by LLMs to compromise developer environments.
- 2024-02 · historyTerm formalization
The term 'slopsquatting' was coined and popularized in security discourse to describe the specific intersection of AI-generated hallucinations and dependency confusion attacks.