Slopsquatting / Hallucination Squatting: When AIs Invent Software Packages
Fatti validati
Developers use AI coding assistants. AIs sometimes invent plausible but non-existent package names (e.g. on npm or PyPI). Criminals register exactly those fake packages and load them with malware.
Spiegato in modo semplice
The fake street-sign trick: A navigation app invents a shortcut, and thieves set up a toll trap at that invented intersection.
Rilevanza per la sicurezza e consiglio pratico
Developers must manually verify every library before installation instead of blindly trusting AI suggestions.
Fonte primaria / riferimento
- Vulcan Cyber Research