Slopsquatting represents an emerging supply chain threat posed by AI. As developers rely heavily on AI coding assistants, they unknowingly give hackers access to their software from day one.
Understanding what slopsquatting is
Slopsquatting is a new type of supply chain attack that uses a large-scale language model (LLM) hallucinations to inject malicious codes in performance improvement. The word includes "AI slop" again "typing," a deceptive practice where attackers register misspelled versions or look like popular domains to attack users who enter URLs incorrectly.
This novel attack vector exploits the tendency of LLMs to create fake software package names, which malicious actors can register and fill with malicious code.
During AI-assisted coding, the model may generate open-source fake packages – bundled collections of files, programs and installation tools. This alone does not mean it is dangerous. However, if an attacker registers that fake package name, they can inject malware directly into the developer’s codebase.
How AI is creating supply chain risks
Traditionally, AI safety hazards are caused by visual impairmentswhich can have a negative impact on users who treat misinformation as valid. However, those same hallucinations have evolved into an exploitable security vulnerability.
Typosquatting is a tricky practice where a hacker registers a misspelled version of a popular package to trick developers. It’s been around for decades, so registrants have built defenses against it.
However, AI has changed the threat model. It recommends creative packages that make sense rather than simple misspellings. Once attackers learn what models of spoofed packages are commonly created, they can register malware-filled packages under those names.
Since the target packages are not just typed versions of popular libraries, there are no protections against this practice on average. For example, registration protects against the publication of an attacker "crossenv," the famous squat "cross-env" the parcel. However, it would not indicate "mpn file for cross-env" or "cross-env-extended" such as threats.
The hallucinations are persistent and severe
Even if many LLMs recommend the same forgotten package, widespread compromises can still occur. Malicious packages can remain undetected in production for months or even years, allowing malicious actors to automatically inject malware into multiple environments.
One study the team analyzed 31,267 vulnerabilities which is part of 14,675 packages in 10 programming languages. They found that reported vulnerabilities are increasing at an annual rate of 98%, a faster growth than the 25% annual increase in the number of open source software packages. The team also saw an 85% increase in the average life expectancy at risk, indicating a decrease in safety.
Real-world dangers of AI ideas
Malicious actors can create open access packages under the same name as the commonly spoofed library. Instead of normal code, they are filled with malware. Models are believed to refer to existing packages, so they often repeat the same associated names. Since bad ideas don’t happen, attackers can register packages that fool tens of thousands of developers.
These packages appear to be legitimate. The string’s similarity to real libraries makes it stand out. Typing a single character suggests simple mistakes rather than malicious intent. Even completely made-up words are always believable when the AI presents them correctly. Discovery is challenging, as developers rely on their coding assistants to recommend valid dependencies.
Why do LLMs cheat packages?
LLMs produce a statistically probable answer instead of prioritizing accuracy. As a result, hallucinations are common. Another study found levels of dreaming from 50% to 82%depending on the model and method of notification. Even with GPT-4o, the most efficient model, it is not less than 23%, even with a fast supported reduction.
Attacks of adversarial hallucination can exacerbate this problem. Threat actors can use token level manipulation or poison retrieval to force models to see things they don’t want, increasing the likelihood that models will recommend their malicious packages.
Which LLMs are prone to slopsquatting?
Although all LLMs are prone to slopsquatting, some are more prone than others. The probability of generating hallucified packages during code generation depends on the model. Proprietary models are four times less likely to produce packages associated with different ideas than open source models.
One group of researchers proved this by running 30 tests across 30 different systems. In this 576,000 code samples and of the 2.23 million parcels it produced, 19.7% were negative impressions. GPT-4.0 Turbo had a dream rate of 3.59%, while DeepSeek 1B, the most efficient open source model, reached 13.63%.
This study suggests that organizations that rely on open source AI tools for code generation are four times more exposed to slopsquatting attacks. That doesn’t mean proprietary tools will always be safe, though. If attackers notice this discrepancy, they may use proprietary LLMs to exploit the perceived security advantage.
Coding with Vibe contributes to the problem
Software developers using AI tools estimate that more than 40 percent of the code volunteers including AI assistance. They expect that percentage to grow significantly over the next few years. Already, 72% of those who have tried AI use it every day.
The uptick in vibe coding and AI-assisted coding is increasing the threat landscape. As more developers incorporate AI tools into their operations without performing proper validation processes, the slopsquatting attack surface continues to grow.
For those using AI to help with coding, double-checking is essential. Ensuring that recommended packages actually exist in official repositories before deploying them to projects minimizes risk.
Navigating AI-assisted development
Using automated checks that validate package names against known registries can help catch packages associated with concepts before they enter production code. Security teams should also monitor for unusual package installations and maintain up-to-date threat intelligence on known slopsquatting campaigns.
Zac Amos is the Features Editor at ReHack.
