Beyond Typosquatting: The Rise of Slopsquatting as a New AI Coding Threat to Software Supply Chains

0 4 minutes read

Slopsquatting is a newly identified threat within supply chain security, exacerbated by the phenomenon of AI hallucinations. As software developers increasingly utilize AI coding assistants, they inadvertently open the door for cybercriminals from the very beginning of the software development process.

What is Slopsquatting?

Slopsquatting represents a unique form of supply chain attack where attackers leverage large language models (LLMs) that produce erroneous or fictitious software package names. The term merges “AI slop” with “typosquatting,” a tactic where criminals register misspelled or similar-sounding domains to deceive users who mistype URLs.

This emerging attack exploits the inclination of LLMs to generate non-existent software package names, which malicious actors can register and then fill with harmful code.

While AI-assisted coding can generate fake open-source packages—which may initially appear harmless—if a hacker registers one of these fictitious names, they can insert malicious software directly into a developer’s codebase.

The Supply Chain Risks of AI

Historically, safety concerns associated with AI stemmed from hallucinations, leading users to mistakenly accept false information as truth. These hallucinations, however, have now become critical security vulnerabilities.

Typosquatting has long been a technique for cybercriminals, involving the registration of misspelled versions of popular packages to deceive developers. While protections have been established against this method, AI has altered the threat landscape by suggesting wholly fabricated package names rather than mere typographical errors. This evolution allows attackers to create malicious packages that mimic plausible ones suggested by LLMs.

Since these hallucinated packages do not simply involve typographical errors, there are often no existing protections against them. For instance, while a registry may block “crossenv,” which is a misspelling of the well-known “cross-env” package, it would likely miss “mpn install cross-env file” or “cross-env-extended” as threats.

Persistent and Serious Hallucinations

Even if many LLMs produce the same fictitious package names, a widespread compromise remains possible. These harmful packages can go unnoticed in production environments for extended periods, potentially allowing malicious actors to surreptitiously introduce malware in numerous settings.

A recent analysis of 31,267 vulnerabilities across 14,675 packages showed a staggering 98% annual increase in reported vulnerabilities, significantly outpacing the 25% annual growth of open-source packages. Furthermore, the average lifespan of these vulnerabilities has extended by 85%, indicating deteriorating security measures.

The Real-World Implications of AI Hallucinations

Malicious entities can establish openly accessible packages that bear the names of commonly hallucinated libraries but contain harmful code. LLMs may inadvertently perpetuate these names because they assume they refer to established packages, leading to widespread confusion among developers.

These deceptive packages can easily be mistaken for legitimate ones due to their name similarities, which can appear as simple typos. In some cases, entirely fabricated names may still seem plausible when introduced by the AI in relevant contexts, complicating detection efforts. Developers often place their trust in coding assistants, further obscuring risks.

Why Do LLMs Hallucinate Packages?

LLMs prioritize generating statistically likely responses over ensuring accuracy, leading to a notable frequency of hallucinations. Studies reveal that hallucination rates can vary between 50% and 82%, depending on the model being examined. Even advanced models, like GPT-4.0, maintain a minimum hallucination rate of 23%, despite efforts to mitigate these issues.

Adversarial hallucination attacks could compound the problem, allowing adversaries to manipulate models into generating targeted hallucinations, thereby increasing the chances that malicious packages are recommended.

Vulnerabilities Across LLMs

While all LLMs can fall victim to slopsquatting, some models possess a higher susceptibility than others. Proprietary models tend to produce hallucinated packages four times less frequently than their open-source counterparts.

Research from a series of 30 tests across various systems indicated that out of 576,000 code samples and more than 2 million produced packages, 19.7% were hallucinations. Notably, GPT-4.0 Turbo demonstrated a hallucination rate of 3.59%, whereas DeepSeek 1B, the top-performing open-source model, recorded a rate of 13.63%.

This information suggests that organizations utilizing open-source AI tools for code development are approximately four times more vulnerable to slopsquatting attacks. While proprietary tools may present reduced risk, attackers could quickly adapt their tactics to target these platforms as well.

The Influence of Vibe Coding

Developers who employ AI tools estimate that over 40% of their code involves AI assistance, a figure poised for significant growth in the coming years. A majority—72%—of developers who have experimented with AI tools now utilize them daily.

The rise of vibe coding and AI integration into coding workflows expands potential vulnerabilities. As more developers embrace AI without adequate verification practices, the risk of slopsquatting increases.

For those utilizing AI in coding tasks, it is imperative to verify the accuracy of suggested outputs. Ensuring that proposed packages exist in recognized repositories is crucial to minimizing risks.

Best Practices for AI-Assisted Development

To combat the issue of hallucinated packages, organizations should implement automated checks that confirm package names against known registries before deploying them in production environments. Security teams must also stay vigilant for unusual package installations and continually update their threat intelligence regarding known slopsquatting campaigns.

Zac Amos is a Features Editor.

We welcome contributions from the tech community!

Our guest posting initiative provides a platform for experts to share valuable insights about AI, cybersecurity, data infrastructure, and the transformative technologies influencing the enterprise landscape.