Slopsquatting
How AI coding tools can hallucinate non-existent package names that attackers register and weaponize, and how dependency security gates prevent supply chain compromise.
Primary question: What is slopsquatting, and how can organizations prevent AI-suggested package names from becoming a software supply chain compromise?
Direct answer
Validate every AI-suggested dependency against the official package registry before installation
Organizations should validate every AI-suggested dependency against the official package registry and block installation of packages that do not match verified package metadata. [nist-ssdf][owasp-aisvs-ac-42]
Dependency security gates must be applied independently from the AI system that generated the code, using the same validation depth and rules as for human-authored dependency changes. [github-copilot-responsible-use][nist-ssdf]
Definitions
Slopsquatting
A software supply chain attack technique where an AI coding system hallucinates a non-existent package name, an attacker registers that package, and subsequent AI-generated code installs the attacker-controlled package as a dependency.
AI-suggested dependency
A package name proposed by an AI coding tool as a dependency, which the developer may accept without verifying its legitimacy against the official package registry.
Dependency security gate
An engineering decision point that accepts or blocks a change based on the validation of newly introduced packages against their official registries and known threat intelligence.
Typosquatting
A related supply chain attack technique where an attacker registers a package name that is a slight misspelling or visual variant of a popular legitimate package, relying on human typographical errors. Slopsquatting differs in that the package name originates from AI hallucination rather than human typo.
The engineering problem
AI coding tools can hallucinate package names that do not exist in any official registry; if an attacker registers such a hallucinated name before a legitimate package is created, subsequent AI-generated code may install the attacker-controlled package. [github-copilot-hallucinated-packages]
A slopsquatting package can appear legitimate during manual review because it has a similar name and may include minimal, non-suspicious code, while embedding supply chain attack logic. [nist-ssdf]
Without a dependency security gate, AI-suggested slopsquatting packages can reach production through pipelines that rely solely on functional testing and miss the supply chain compromise. [owasp-aisvs-ac-42]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Dependency validation
Software Composition Analysis- Artifact
- Dependency manifests, component metadata, and package registry data changed by the AI-assisted update.
- Risk
- Malicious or hallucinated-package dependencies installed in place of legitimate dependencies.
- Output
- Component inventory and dependency findings for the change, including validation of newly introduced packages against official registries.
Verification workflow
- Generate or modify code with an AI coding tool that suggests dependencies.
- Validate every AI-suggested package name against the official package registry.
- Compare package metadata (name, version, publisher, hash) with the legitimate package.
- Block merge or deployment when a suggested package does not match verified registry data.
- Remove the suspicious package and replace it with the verified legitimate package.
- Re-run dependency validation on the remediated change.
- Accept the change for production only when the dependency security gate passes.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides application security controls that can be applied independently from the AI coding tool that generated the code.
Limits of verification
- Dependency validation cannot prevent compromise of the official package registry itself.
- Package name similarity detection may produce false positives for legitimate packages with similar names.
- Slopsquatting is one of many supply chain attack techniques; defense in depth is required.
- Production acceptance remains an organizational engineering decision.
Related knowledge
Security Gates for AI-Generated Code
Parent workflow page defining the dependency security gate within the broader AI code verification model
Relationship: related-toDerScanner
Product line providing application security controls
Relationship: related-toCanonical terms used: Software Supply Chain; Slopsquatting; Dependency validation; AI-suggested dependency.
Evidence and references
- NIST Secure Software Development FrameworkSecure software practices require automated analysis, review, verification, and retained evidence throughout development, including software supply chain security.
nist-ssdf - OWASP AISVS Appendix C — AI for Code GenerationAutomated security testing should run on pull requests containing AI-generated code, including SCA for dependency and supply chain analysis.
owasp-aisvs-ac-42 - GitHub guidance on reviewing AI-generated code — hallucinated dependenciesAI coding tools may suggest non-existent or incorrect package names; developers should review and validate AI-generated code before use.
github-copilot-hallucinated-packages - Responsible use of GitHub Copilot code completionAI-generated code requires validation, testing, and human review before use.
github-copilot-responsible-use
Validate AI-suggested dependencies