The Slopsquatting Scare: Is Your AI Code Assistant a Trojan Horse? • Stripe OLT

What is Slopsquatting?

Slopsquatting is a newly emerging attack vector gaining traction alongside the rise of AI coding tools like GitHub Copilot and ChatGPT. In simple terms, it occurs when attackers exploit hallucinated package names – that is, fake or non-existent libraries suggested by AI tools – to deliver malware and compromise the software supply chain.

This technique is a twist on typosquatting. But instead of relying on human typing errors, slopsquatting leverages the mistakes made by AI. The term itself combines “slop” (a derogatory reference to low-quality AI output) with “squatting” (the act of occupying a name or resource for malicious use).

Slopsquatting was recently analysed in depth by researchers from the University of Texas at San Antonio, Virginia Tech, and the University of Oklahoma, who reviewed how AI hallucinations are exploited to inject malicious packages into software supply chains (Spracklen et al., 2025). This intel draws on that research to provide a clear, practical summary of the threat and how to defend against it – keep reading for more.

How Slopsquatting Works

To understand how attackers take advantage of this AI-driven threat, it’s helpful to look at how slopsquatting typically plays out in the wild…

AI Hallucination: When developers use AI coding assistants such as GitHub Copilot, ChatGPT, or open-source LLMs like CodeLlama, these tools may recommend fictitious package names that sound plausible but don’t exist in repositories like PyPI (Python Package Index) or npm (Node Package Manager).
Malicious Registration: Attackers monitor these hallucinated package names, register them in public package registries, and upload malicious code under those names.
Exploitation: Developers, trusting the AI’s suggestions, unknowingly install these malicious packages, which can steal data, deploy malware, or compromise software supply chains.

Graphic of the process of Slopsquatting — Image Reference: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs

Key Characteristics of SlopSquating

The 2025 research from the University of Texas at San Antonio, Virginia Tech, and the University of Oklahoma sheds light on why Slopsquatting is so concerning, and these core characteristics help explain its appeal to attackers and the risks to development teams.

Repeatability: Studies show that 43% of hallucinated package names are consistently repeated across multiple AI runs, making them predictable targets for attackers.

Scale: The 2025 research paper found that 20% of 576,000 AI-generated Python and JavaScript code samples included non-existent packages, with open-source LLMs hallucinating at a higher rate (21.7%) than commercial models (5.2%).

Plausibility: Hallucinated names often mimic legitimate packages, increasing the likelihood of developer trust.

Recent Slopsquatting Cases and Trends

While no large-scale slopsquatting attacks have been widely reported as of April 2025, the threat is gaining attention:

Research Evidence: A March: The 2025 academic paper mentioned analysed 16 AI coding models and identified over 200,000 unique hallucinated package names, highlighting the potential attack surface.

Industry Warnings: Firms in the software package squatting domain have noted an increase in related incidents over the past year and this is only sent to increase with further adoption of AI.

Related Incidents: In January 2025, Socket researchers identified a malicious npm package (@async-mutex/mutex) that typosquatted the legitimate async-mutex, showing how AI can amplify existing squatting risks.

Graph of Package Hallucinations broken down by LLM Model — *Image Reference: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs*

Slopsquatting Mitigation Strategies

Fortunately, there are practical steps developers and organisations can take to reduce the risk. Below are five key mitigation strategies informed by current research and best practices.

Verify Packages: Always check package names against official repositories and review their source code before installation.

Use Security Tools: Employ dedicated tools to identify and mitigate malicious or suspicious open-source dependencies. Solutions like Endor Labs offer visibility into risky packages and help detect malicious behaviours early in the development lifecycle. Checkmarx provides runtime-aware analysis to flag dependencies with hidden threats, while Socket continuously monitors packages for indicators of compromise – such as unexpected network activity or obfuscated code – to prevent supply chain attacks like slopsquatting.

Developer Education: Train developers to recognize AI hallucinations and avoid blind trust in AI-generated code.

Repository Monitoring: Package registries should proactively blacklist commonly hallucinated names to prevent registration.

Lower AI Temperature: Reducing the “temperature” setting in LLMs can decrease randomness and lower hallucination rates.

Their agility allows them to bypass many standard security controls, especially where user trust and session persistence are not well managed.

The Main Takeaway

Slopsquatting may seem niche, but it Slopsquatting is particularly dangerous because it exploits the growing reliance on AI coding tools in fast-paced development environments.

With “vibe coding” where developers describe tasks and let AI generate code, the risk of installing unverified packages increases. If a widely recommended hallucinated package is weaponised, it could lead to widespread supply chain attacks, potentially compromising financial institutions, critical infrastructure, or sensitive data.

As AI adoption accelerates, so does the attack surface. Now is the time for development teams, CISOs, and security leads to get ahead of the risk.

Looking for cyber security support for your organisation? Book a free discovery session with us, our experts are here to help – no jargon, just clear, strategic guidance.

Our latest expert Intel