---
title: "Slopsquatting: when your AI's mistake becomes an attack."
url: https://daily.dev/posts/slopsquatting-when-your-ai-s-mistake-becomes-an-attack--oozh0xrrs
source_url: https://daily.dev/posts/slopsquatting-when-your-ai-s-mistake-becomes-an-attack--oozh0xrrs
type: freeform
source: "Dev World"
author: "Julia"
published: 2026-07-08T09:44:17.217Z
updated: 2026-07-08T09:44:39.633Z
tags: ["security", "python", "npm"]
reading_time: 2
upvotes: 2
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Slopsquatting: when your AI's mistake becomes an attack.

**[Dev World](https://daily.dev/sources/dev_world)** · [@julia7](https://daily.dev/julia7) · 2 min read · 2 upvotes · 0 comments

## Summary

Slopsquatting is an emerging supply chain attack that exploits AI coding assistants' tendency to hallucinate package names. Roughly 1 in 5 packages suggested by AI tools don't exist, and crucially, these fabricated names are consistent across sessions and models. Attackers monitor for these recurring fake names, register them on npm and PyPI, and load them with malicious code. One demonstration package received 30,000+ real downloads in three months, and confirmed malicious packages using this pattern are already live in registries. The post promotes a free live session on July 22nd covering how the attack works and detection strategies.

## Content

**The package your AI just told you to install? Someone beat you to registering it, and it's not empty.**

Here's something that came out of USENIX Security 2025 that's worth knowing if you use any AI assistant to write code: about 1 in 5 packages these tools suggest are complete fabrications. They just don't exist.

The weird part isn't that AI makes things up, we all know that happens. It's that it makes up the _same_ thing, consistently, across sessions and even across different models. That predictability is exactly what turned this into an attack.

People started watching for these repeat-offender fake names, claiming them on npm and PyPI before anyone else could, and quietly loading them with malicious code. The next time an AI suggests that name and someone runs the install, the trap is already set. This is being called slopsquatting.

Some context on how far this has gone:

- One researcher's test package, meant purely as a demonstration, ended up with 30,000+ real downloads in three months
- There are already confirmed malicious packages riding this exact pattern in live registries
- And with AI now responsible for a huge chunk of the code shipped daily, this keeps happening faster than most teams can react to it

If this is new to you (it was new to a lot of us too), we're breaking it down in a free live session on July 22nd: how the attack actually works, and a practical way to catch a malicious package before any signature or blocklist even knows it exists.

📅 July 22nd | 10:30 CEST
👉 Register here: [https://www.linkedin.com/events/7480522038990979074/](https://www.linkedin.com/events/7480522038990979074/)

𝐘𝐨𝐮 𝐜𝐚𝐧'𝐭 𝐝𝐞𝐟𝐞𝐧𝐝 𝐰𝐡𝐚𝐭 𝐲𝐨𝐮 𝐜𝐚𝐧'𝐭 𝐬𝐞𝐞.

---

Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#npm](https://daily.dev/tags/npm)

[View this post on daily.dev](https://daily.dev/posts/slopsquatting-when-your-ai-s-mistake-becomes-an-attack--oozh0xrrs)