supply-chain

Slopsquatting is the name for a new software supply chain attack built directly on LLM package hallucinations. The source frames it as a category shift from typosquatting: instead of betting on developer typos, attackers register the non-existent package names that AI coding assistants confidently invent, then upload malware under

Slopsquatting reframes LLM hallucinations as a supply chain attack surface rather than a quality problem, according to a recent ReHack analysis. The technique works because hallucinated package names are statistically predictable outputs, not random errors. That predictability is the property attackers exploit, because any name a model generates at scale