Introduction

Imagine this: You ask ChatGPT for a quick way to parse invoices in Node.js. It confidently suggests installing pdf-invoice-parser. You run:

npm install pdf-invoice-parser

unaware that the package doesn’t exist—until now. A malicious actor just published it yesterday. And you? You’ve just introduced malware into your application.

Welcome to the world of Slopsquatting — a new class of software supply chain attacks born from AI hallucinations.

What Is Slopsquatting?

Slopsquatting is when attackers upload malicious packages to public repositories (like npm or PyPI) using names that:

• Are hallucinated by AI assistants like ChatGPT or GitHub Copilot
• Don’t exist in real package indexes
• Look plausible enough for developers to trust at first glance

It’s a subtle evolution of typosquatting and dependency confusion, but with a dangerous AI twist.

Why It’s a Problem Now

LLMs (Large Language Models) are not search engines. They generate content based on patterns in data — and sometimes that means making up package names.

They sound real. They look real. But they’re fake.

This isn’t just hypothetical. Security researchers have already found that AI assistants frequently hallucinate library names, especially for niche use cases.

Malicious actors are watching. They’re registering these “AI-inspired” packages in bulk. Developers install them. And that’s when the damage begins.

Real Examples of AI-Aided Attacks

• AI-Generated Hallucinations Caught in the Wild (2023–2024): Researchers from Protect AI demonstrated dozens of hallucinated package names suggested by ChatGPT. Some were later found uploaded as malicious packages.
• Dependency Confusion Attack at Microsoft: In 2021, a researcher tricked Microsoft and other tech giants by publishing public versions of internal dependency names. The packages were installed over 20 million times.
• Fake PyPI Packages Mimicking Hallucinated Suggestions: Names like datascience-utils-pro or auth-flask-client appeared on PyPI—packages that were frequently hallucinated by LLMs.

Why This Is a Serious Threat

• Malware Injection: Fake packages can include backdoors, keyloggers, or cryptominers.
• CI/CD Compromise: Packages often run in privileged build environments.
• Credential Leaks: Attackers can exfiltrate API keys or .env files.
• Regulatory Issues: GDPR or HIPAA violations may occur due to data leaks.

All from one innocent-looking npm install.

How to Protect Yourself and Your Team

• Don’t Blindly Trust AI Suggestions: Verify package names manually on official registries such as:

  • npmjs.com
  • pypi.org
  • rubygems.org

• Lock and Scan Dependencies: Use tools like:

  • npm audit
  • pip-audit
  • Socket.dev
  • Deps.dev by Google

• Monitor for Suspicious Packages: Set alerts for newly published packages that resemble your internal or commonly used dependencies.

• Educate Your Developers: Make sure your team understands:

  "AI is helpful, but it can hallucinate. Always double-check."

Bonus: Tools to Use

• Sigstore / Cosign: Package signing and verification
• JFrog Xray: Software composition analysis
• Socket Security: Malicious package detection
• npq / pipdeptree: Dependency chain visualization