Slopsquatting: AI's Contribution to Supply Chain Attacks

Slopsquatting is an emerging software supply-chain vulnerability in which AI code-generation tools hallucinate nonexistent package names; adversaries can register those fabricated names and distribute malicious packages. The report reviews research showing significant hallucination rates (commercial models ~5.2%, open-source ~21.7%), notes the large scale of dependency use and past package hijacks, and recommends mitigations such as proxying package requests, providing explicit package lists, instructing models to verify packages, and carefully fine-tuning models.