Slopsquatting: the hidden threat hiding inside AI coding tools

Key points

• Slopsquatting is a supply chain attack that exploits AI coding assistants inventing fake software package names, which criminals then register and fill with malicious code.
• One study of 576,000 AI-generated code samples found that 19.7% of the software packages the AI recommended did not exist.
• GPT-4o Turbo, OpenAI's model, hallucinated fake package names at a rate of 3.59%, while open-source models reached rates above 13%.
• Reported software vulnerabilities grew at 98% annually in recent research, nearly four times the 25% annual growth in the number of open-source packages.
• Developers can cut their risk by checking that every package an AI recommends actually exists in an official registry before installing it.

Every time a developer asks an AI coding assistant to write software, the AI may casually recommend a package, a pre-built bundle of code that other programmers share freely online, that simply does not exist. The AI invented it. That sounds harmless until you learn that criminals are watching for exactly this.

The attack is called slopsquatting. The name blends "AI slop," internet slang for low-quality AI output, with "typosquatting," an old trick where criminals register website or package names that look like the real thing but contain one deliberate spelling mistake. Slopsquatting goes further: the fake name was never a misspelling of anything. The AI conjured it whole.

Here is how it plays out. A developer asks their AI assistant, say GitHub Copilot or ChatGPT, to add a feature to their app. The AI writes working code that imports a package called something like "cross-env-extended." The developer runs it. Their computer fetches that package from the internet and installs it. If a criminal registered that name first and loaded it with malware, the developer just handed over the keys.

Defences that exist today do not cover this. Package registries, the online libraries where developers download code, already block obvious typos of popular packages. They would catch "crossenv" as a fake version of "cross-env." They have no way to flag "cross-env-extended" because the name sounds perfectly legitimate.

The scale of the problem is sobering. A study cited by VentureBeat analysed nearly 576,000 AI-generated code samples and found that roughly one in five package names the AI recommended were fabrications. Even GPT-4o, OpenAI's current flagship model, recommended hallucinated package names at a rate of 3.59% in those tests. Open-source models fared worse: DeepSeek 1B, the best-performing open model tested, still hit 13.63%, making open-source AI tools roughly four times riskier on this measure.

The hallucinations are not random, which is what makes them dangerous. Models tend to invent the same fake names repeatedly. A criminal who maps which names a popular model favours can register a handful of packages and wait for thousands of developers to install them automatically.

What should developers actually do?

The simplest step is also the most effective: before your project installs any package an AI recommends, search for it yourself in the official registry, such as npmjs.com for JavaScript or PyPI for Python. If it is not there, do not use it.

Teams can go further by setting up automated checks, scripts that compare every package name in a project against the official registry before the code ships. Security teams should also track known slopsquatting campaigns the same way they track phishing trends.

More than 40% of code developers commit today already includes AI assistance, and that share is rising. The more that AI writes code without human review, the wider the opening becomes. The fix is not to stop using AI tools. It is to treat their output as a first draft that still needs a basic fact-check.

One sentence of verification can close a door that criminals are actively pushing on.