Slopsquatting represents a supply chain threat made possible by artificial intelligence hallucinations. As developers increasingly rely on AI coding assistants, they are unwittingly giving away grants cybercriminals access to their software from day one.
Understanding what slopsquatting is
Slopsquatting is a new supply chain attack that uses the large language model (LLM). hallucinations to inject malicious code to development workflows. Combines the term "AI bending" and "typo," a deceptive practice in which attackers register misspelled or similar versions of popular domains to prey on users who enter URLs incorrectly.
This new attack vector exploits the tendency of LLMs to create fictitious software package names, which threat actors can then log in and fill with malicious code.
During AI-assisted coding, the model can create fake open-source packages—stacked collections of files, programs, and installation tools. This alone is not necessarily harmful. However, if an attacker mentions that fake package name, they can inject malware directly into the developer’s codebase.
How AI creates supply chain risk
Traditionally, AI security risks stem from hallucinationscan have a negative effect on users who believe false information to be reliable. However, those same hallucinations have turned into exploitable security vulnerabilities.
Typosquatting is a deceptive practice in which a cybercriminal registers a misspelled version of a popular package to trick developers. It’s been around for decades, so registries have built in protection against it.
However, AI has changed hazard model. It recommends fictitious packages that sound convincing rather than making simple typos. Once attackers learn what kind of hallucinatory packages they tend to invent, they can label malware-laden packages under these names.
Since hallucinated packages are not simply written versions of popular libraries, there is no protection against this practice at scale. For example, the registry protects against the publication of an attacker "crossenv," celebrity squats "cross env" package. But he would not define "Install the mpn cross-env file" or "cross env extended" such as threats.
Hallucinations are persistent and severe
Even if many LLMs recommend the same hallucination package, a widespread compromise is still possible. Malicious packages can remain undetected in production for months or even years, allowing threat actors to passively inject malware into countless environments.
A study the team analyzed 31,267 vulnerabilities It covers 14,675 packages across 10 programming languages. They found that, faster than the 25% annual increase in the number of open source software packages, reported vulnerabilities are increasing at a rate of 98% per year. The team also observed an 85% increase in the average lifetime of vulnerabilities, indicating a decrease in security.
Real-world dangers of AI hallucinations
Malicious actors can create open access packages under the same name as common hallucinating libraries. Instead of standard code, they are filled with malware. Models believe they are referring to existing packages, so they often repeat the same hallucinatory names. Because hallucinations are not random, attackers could theoretically mark packages that fool tens of thousands of developers.
These packages appear to be legitimate. String similarity to real libraries makes them recognizable. Single-character typos indicate simple errors rather than malicious intent. Even completely fictitious names remain believable when AI presents them in the proper context. It’s hard to detect because developers rely on coding assistants to recommend valid dependencies.
Why do LLMs hallucinate packages?
LLMs generate the statistically most likely answer rather than prioritizing accuracy. As a result, hallucinations are relatively common. One study found rates of hallucinations It ranges from 50% to 82%depending on the model and the calling method. Even the best-performing model, GPT-4o, doesn’t drop below 23% even with the operational-based reduction.
Enemy hallucination attacks can make this problem worse. Threat actors can use token-level manipulation or search poisoning to force models to hallucinate the way they want, making the models more likely to recommend malicious packages.
Which LLMs tend to lean?
While all LLMs are prone to bending, some are more susceptible than others. The probability of producing hallucinatory packets during code generation depends on the model. Proprietary models are four times less likely to create hallucinatory packages than open source models.
A research team proved this by running 30 tests on 30 different systems. Out 576,000 code examples and of the 2.23 million packets it produced, 19.7% were hallucinations. GPT-4.0 Turbo had a hallucination rate of 3.59%, while the best performing open source model, DeepSeek 1B, reached 13.63%.
This research shows that organizations that rely on open source AI tools to generate code are nearly four times more likely to be exposed to slopsquatting attacks. This does not necessarily mean that proprietary tools will always remain more secure. Once attackers realize this disparity, they can manipulate proprietary LLMs to take advantage of perceived security.
Vibe coding helps the problem
Software developers using artificial intelligence tools guess this more than 40 percent of the code their commitment includes AI assistance. They expect this percentage to increase significantly over the next few years. 72% of those who already use AI use it on a daily basis.
Growth in Vibe coding and AI-powered coding is strengthening the threat surface. As more developers integrate AI tools into their workflows without implementing proper validation processes, the attack surface for slopsquatting continues to expand.
For those using AI to help with coding, it’s important to double-check the output. It reduces risk by checking that recommended packages are actually available in official repositories before they are included in projects.
Navigating AI-powered development
Implementing automated checks that validate package names against known registries can help catch rogue packages before they enter production code. Security teams should also monitor unusual package installations and maintain up-to-date threat intelligence on known slopsquatting campaigns.
Zac Amos is the Features Editor Hack again.
