Slopsquatting / Hallucination Squatting: When AIs Invent Software Packages
Validated facts
Developers use AI coding assistants. AIs sometimes invent plausible but non-existent package names (e.g. on npm or PyPI). Criminals register exactly those fake packages and load them with malware.
In plain language
The fake street-sign trick: A navigation app invents a shortcut, and thieves set up a toll trap at that invented intersection.
Security relevance & practical tip
Developers must manually verify every library before installation instead of blindly trusting AI suggestions.
Primary source / reference
- Vulcan Cyber Research