Slopsquatting / Hallucination Squatting: When AIs Invent Software Packages
Factos validados
Developers use AI coding assistants. AIs sometimes invent plausible but non-existent package names (e.g. on npm or PyPI). Criminals register exactly those fake packages and load them with malware.
Explicação simples
The fake street-sign trick: A navigation app invents a shortcut, and thieves set up a toll trap at that invented intersection.
Relevância de segurança e dica prática
Developers must manually verify every library before installation instead of blindly trusting AI suggestions.
Fonte primária / referência
- Vulcan Cyber Research