Slopsquatting / Hallucination Squatting: When AIs Invent Software Packages
Hechos validados
Developers use AI coding assistants. AIs sometimes invent plausible but non-existent package names (e.g. on npm or PyPI). Criminals register exactly those fake packages and load them with malware.
Explicación sencilla
The fake street-sign trick: A navigation app invents a shortcut, and thieves set up a toll trap at that invented intersection.
Relevancia de seguridad y consejo práctico
Developers must manually verify every library before installation instead of blindly trusting AI suggestions.
Fuente primaria / referencia
- Vulcan Cyber Research