Slopsquatting
What vendors mean: nothing — this is an attack, not a product. What it actually means: hackers registering the fake software packages that AI coding tools hallucinate, so your AI-written code installs their malware.
The term
Slopsquatting is a supply-chain attack that exploits a specific AI failure: coding assistants sometimes invent plausible-sounding names for software libraries that don’t exist. Attackers watch for these hallucinated names, register real malicious packages under them, and wait for the next developer whose AI suggests the same fake dependency to install it.
Why it matters to you
This is where vibe coding meets real risk. AI-generated code that pulls in dependencies can pull in a poisoned one, and it happens quietly — the code runs, and the malware ships with it. As more of your software (and your vendors’ software) is AI-assisted, this attack surface grows.
What that means in practice: Any AI-written code that installs packages needs a human to verify each dependency is real and trusted before it runs — ideally against an approved internal registry. This is a concrete, non-negotiable review step, not a theoretical worry. Ask your engineering leaders and your software vendors how they guard against it.