Supply chain
What is slopsquatting?
Slopsquatting is an attack that registers package names invented by AI coding assistants. When a model suggests a package that does not exist, an attacker can publish malware under that name, and the next developer or agent to follow the suggestion installs it. It is typosquatting without the typo.
Updated
Where the name comes from
The term is a play on typosquatting, with "slop" meaning low-quality AI output. It is credited to Seth Larson, security developer-in-residence at the Python Software Foundation, in 2025.
How package hallucination happens
A language model writes what looks likely. A plausible name such as a library for a common task can look just as likely as a real one, so the model sometimes writes an import or install command for a package nobody ever published.
A study presented at USENIX Security 2025 tested 16 popular models on 576,000 code samples. The share of hallucinated packages was at least 5.2% for commercial models and 21.7% for open source models, with 205,474 unique invented names. The researchers described the problem as persistent and systemic.
How a slopsquatting attack works
- Collect the names. The attacker asks models common coding questions and notes which packages do not exist.
- Publish them. They register those names on npm or PyPI, with a working package that hides a payload.
- Wait. A developer pastes the suggestion, or a coding agent runs the install on its own.
- Run. An install script executes on the developer's machine or in CI, with access to tokens and secrets.
Slopsquatting vs typosquatting
| Typosquatting | Slopsquatting | |
|---|---|---|
| Source of the error | A person mistypes a name | A model invents a name |
| The name | Close to a real package | Plausible, with no real package behind it |
| Who installs it | A developer | A developer, or an agent with no human reading the name |
| Why detection is harder | Lookalike checks can compare it with popular names | There may be no popular name to compare it with |
Why coding agents raise the stakes
With a chat assistant, a person reads the suggestion before running it. A coding agent can write the code, add the dependency and run the install in one step. The human check that catches many bad names is gone, and the install happens wherever the agent runs, often with the developer's credentials or inside CI. For the wider picture, see security for AI-assisted development.
How to protect against slopsquatting
- Verify before you install. Check that a suggested package exists, has a real repository and has a history. A package created last week deserves suspicion.
- Review lockfile changes. New dependencies should be visible in pull requests, whoever or whatever wrote the code. See what a lockfile records.
- Limit what agents can do. Require approval before an agent installs packages, and run agents in a sandbox with no production credentials.
- Delay new packages. A rule against packages published in the last few days helps.
- Disable install scripts where your build allows it.
- Restrict outbound traffic from builds. A package that cannot reach the attacker cannot send your secrets anywhere. See GitHub Actions egress policy.
A new slopsquatting package has no advisory, so an SCA scan or npm audit will not report it. For the full list of controls, see software supply chain security best practices.
How CRACI limits the damage
CRACI does not detect new malicious packages, so vet them with other tools. What it does is limit the harm when one reaches your build. As your GitHub Actions runner, it enforces an egress policy that blocks connections the build does not need, which protects you even when nobody has seen the attack before. It also records every package each job fetched, so once a bad package is known, you can see which builds pulled it in.
Slopsquatting: frequently asked questions
What is slopsquatting?
An attack in which someone registers package names that AI coding assistants invent, so that anyone who follows the suggestion installs the attacker's code.
Who coined the term slopsquatting?
It is credited to Seth Larson, security developer-in-residence at the Python Software Foundation, in 2025.
What is a hallucinated package?
A package name that an AI model suggests even though no such package exists. Research has found this in a significant share of generated code samples.
How is slopsquatting different from typosquatting?
Typosquatting relies on a person mistyping a real package name. Slopsquatting relies on a model inventing a name that never existed, so there is no real package to compare it with.
How do you prevent slopsquatting?
Verify that suggested packages are real, review new dependencies in pull requests, require approval before agents install anything, and restrict outbound traffic from builds.
Contain the package nobody meant to install
Block the outbound connections your builds do not need, and keep a record of every package they fetched.
Book a demo