(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this:

what the efff is slopsquatting????

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

TL;DR

Key Points

• Assume AI tools will propose non-existent dependencies; ~20% of sampled AI outputs do, and 43% of those names repeat—making them targetable at scale.

• Block unknown packages by default with internal proxies/allowlists and hash-pinned deps; make new names an exception, not a path of least resistance.

• Watch for fresh npm/PyPI lookups, first-seen package installs, and build steps that fetch from public registries without provenance.

• Instrument CI/CD to surface “new-to-org” dependencies as a policy event with human approval.

• Plan for higher near-term risk in JavaScript/Python ecosystems over the next 30–90 days as adoption of code assistants grows.

The story in 60 seconds

• Who/what/why: Slopsquatting abuses AI hallucinations—non-existent yet plausible package names produced by code assistants. Adversaries pre-register those names in public registries, then wait for devs or CI to auto-install them.

• TTPs: Registration of plausible names; malicious postinstall/setup.py scripts; collection of environment variables and tokens; outbound beacons to attacker infrastructure; optional version pinning to survive dependency updates. Relevant ATT&CK: T1195 (Supply Chain), T1204 (User Execution), T1566 (Phishing, when lured via snippets), T1598 (Search Open Repositories), TA0005/TA0006 (Defense Evasion/Cred Exfil).

• Sector impact: Highest exposure where JavaScript/Python dominate and build speed trumps review. Orgs with permissive registries and no “first-seen dependency” control face the most risk over the next quarter.

Why it matters

SOC

• Spike in DNS/HTTP(S) to registry.npmjs.org, pypi.org (or mirrors) for first-seen package names.
• npm install / pip install events in build agents or developer endpoints outside standard windows.
• Code execution from package postinstall/setup.py/entry_points during build or test stages.

IR

• Triage: identify the first build that pulled the malicious package; capture the package tarball/wheel and build logs.
• Preserve: CI job artifacts, lockfiles, .npmrc/pip.conf, resolver logs, and developer terminal history.
• Hunt: lateral movement or secrets exfil via install scripts (tokens, .npmrc, .pypirc, cloud creds).

SecOps

• Enforce allowlist proxy for registries; require human approval for new-to-org packages.
• Mandate lockfiles + hash pinning (npm package-lock.json/npm ci, Python pip-tools/--require-hashes).
• Turn on SCA (software composition analysis) with “first-seen dep” policy gates.

Strategic

• Make “AI-generated code safety” a board-visible risk in SDLC policy.
• Assign product owners for dependency hygiene and provenance.
• Require vendors to document how their AI assistants verify package existence.

See it in your telemetry

Network

• First-seen queries or fetches for package names not present in org allowlists.
• Short-lived HTTPS bursts to registry endpoints from CI runners right before build artifacts change.
• Downloads of .tgz (npm) or .whl/.tar.gz (PyPI) from newly created or low-reputation projects.

Endpoint (developer + build agents)

• Processes: npm install, npm ci, pip install, pipx, python setup.py spawning shells or network utilities.
• File mods: creation of new node_modules// or /site-packages// immediately followed by script execution.
• Secrets access: reads of .npmrc, .pypirc, cloud CLI creds right after install.

Code/CI logs

• “Package not in lockfile,” “No matching hash,” or resolver fallbacks to latest.
• First-time dependency approvals (or lack thereof) tied to a specific MR/PR.
• Build steps pulling directly from the internet instead of internal cache/proxy.

High Impact, Quick Wins

• Put a gate in front of registries: Route npm/PyPI through an internal proxy with allowlisting and signed artifact caching. Measure: % of builds fetching only from internal cache; count of blocked first-seen names.

• Make unknown == fail-closed: Enforce lockfiles + hash pinning (npm ci, pip --require-hashes) and block builds that add deps without an approval tag. Measure: build-failure rate due to policy and time-to-approval.

• Surface “first-seen dependency” as a signal: Add a CI policy that creates a ticket and requires reviewer sign-off for any new package. Measure: MTTA from alert to decision; number of new deps per release.

Suggested Pivots

1. How do specific AI code generation models such as (SUBSCRIBE TO UNLOCK!) compare in their rates and patterns of hallucinating non-existent package names, and what fine-tuning or hallucination detection algorithms have proven most effective in reducing slopsquatting risks within these models?
   Justification: Given the 20% prevalence of hallucinated packages and the 43% repeatability rate across AI runs, understanding model-specific vulnerabilities and mitigation techniques is critical for targeted defenses.

2. Which public package repositories—specifically (SUBSCRIBE TO UNLOCK!) are most frequently targeted by slopsquatting attacks, and what automated monitoring techniques (e.g., anomaly detection, semantic similarity analysis, registration timing patterns) provide the highest accuracy and timeliness in detecting malicious registrations? How can these detection systems be integrated into CI/CD pipelines for real-time prevention?
   Justification: Attackers exploit rapid registration of hallucinated names in these repositories; thus, repository-specific detection strategies are essential to prevent supply chain compromise.

3. What organizational (SUBSCRIBE TO UNLOCK!) have been shown in case studies or behavioral research to influence susceptibility to slopsquatting attacks, and what targeted training programs or cultural interventions most effectively reduce blind trust in AI-generated code dependencies?
   Justification: Since developer trust in AI-generated code is a key enabler of slopsquatting, understanding and shaping human factors is vital for comprehensive risk mitigation.

Ready to level up your intelligence game?

Sign Up!

Executive Summary

Slopsquatting is an emergent software supply chain threat that leverages the statistical outputs and hallucinations of large language models (LLMs) used in AI code generation tools. Unlike typosquatting or dependency confusion, slopsquatting targets package names that do not exist but are repeatedly suggested by AI assistants such as GitHub Copilot, ChatGPT, and CodeLlama. Research indicates that 20% of AI-generated code samples include non-existent packages, with 43% of hallucinated names recurring across multiple AI runs, making them predictable and attractive for adversaries.

Threat actors—ranging from opportunistic cybercriminals to APTs—monitor AI outputs and rapidly register these hallucinated names in public repositories (e.g., npm, PyPI), embedding malicious payloads. The attack surface is expanding rapidly due to the widespread adoption of AI-assisted development, especially in high-growth ecosystems like JavaScript and Python. Detection is challenging, as hallucinated names are semantically plausible and not simple misspellings.

Mitigation strategies include integrating advanced dependency scanning and real-time monitoring into CI/CD pipelines, fine-tuning AI models to verify package legitimacy, and training developers to recognize and report suspicious dependencies. Collaboration with AI tool vendors to implement hallucination detection and allowlisting is recommended. Organizations are advised to treat slopsquatting as a board-level risk and adopt secure SDLC practices that address AI-driven supply chain threats.

Short-term forecasts predict a surge in slopsquatting incidents targeting npm and PyPI, with attackers exploiting the repeatability and plausibility of hallucinated names. Long-term, slopsquatting is expected to evolve into a highly automated, hybrid attack vector, prompting regulatory responses and industry-wide adoption of AI risk management in software development pipelines.

Research

Definition and Unique Characteristics of Slopsquatting

• Slopsquatting is a supply chain attack where threat actors register software package names that do not exist but are "hallucinated" (i.e., invented) by AI code generation tools. When developers or automated systems use these AI-generated suggestions, they may inadvertently import malicious packages.
• Distinct from Typosquatting: Typosquatting relies on human typographical errors (e.g., "reqeusts" instead of "requests"). Slopsquatting, by contrast, exploits AI-generated, plausible-sounding package names that do not exist in official repositories.
• Distinct from Dependency Confusion: Dependency confusion attacks exploit the precedence of public over private packages with the same name. Slopsquatting targets entirely new, hallucinated names that are not present in any registry until registered by an attacker.
• Repeatability: Research shows that 43% of hallucinated package names are consistently repeated across multiple AI runs, making them predictable targets for attackers (Stripe OLT, 2025).

Attribution: Threat Actors, Motivations, and TTPs

• Threat Actors: Slopsquatting is accessible to a wide range of actors, from opportunistic cybercriminals to advanced persistent threat (APT) groups, due to the low barrier to entry and high potential impact.
• Motivations: Motivations include financial gain (via malware, ransomware, or cryptomining), espionage, or disruption of software supply chains.
• TTPs (Tactics, Techniques, and Procedures):
  • Monitoring AI code generation outputs, developer forums, and public code repositories for hallucinated package names.
  • Using automated tools or their own LLMs to generate lists of hallucinated names.
  • Rapid registration of these names on public repositories (e.g., npm, PyPI).
  • Embedding malicious payloads in these packages, which are then imported by unsuspecting developers or CI/CD pipelines.
• Underground Activity: While no major slopsquatting campaigns have been publicly attributed to specific threat groups, security vendors and researchers have observed increased chatter in underground forums about exploiting AI-generated package names (FOSSA, 2025).
• Related Incidents: In January 2025, Socket researchers identified a malicious npm package (@async-mutex/mutex) that typosquatted the legitimate async-mutex, showing how AI can amplify existing squatting risks (Stripe OLT, 2025).

Comparative Risk Assessment

• Prevalence: A 2025 academic study found that 20% of 576,000 AI-generated Python and JavaScript code samples included non-existent packages, with open-source LLMs hallucinating at a higher rate (21.7%) than commercial models (5.2%) (FOSSA, 2025).

• Impact: If a hallucinated package becomes widely recommended by AI tools and is registered by an attacker, the potential for widespread compromise is significant.

• Detection Difficulty: Slopsquatting is harder to detect than typosquatting because the names are not simple misspellings but plausible, semantically convincing, and often persistent across multiple AI-generated outputs.

• Incident Evidence: While no large-scale slopsquatting attacks have been widely reported as of mid-2025, the threat is gaining attention. Industry warnings and minor incidents (such as the @async-mutex/mutex npm case) demonstrate the feasibility and growing risk.

• Comparison Table:

  Attack Type	Vector	Exploits	Detection Difficulty	Prevalence (2025)	AI-Enabled?
  Typosquatting	Human error	Misspellings	Moderate	High (Sonatype, 2024)	No
  Dependency Confusion	Registry precedence	Name collision	High	Moderate (FOSSA, 2021)	No
  Slopsquatting	AI hallucination	Nonexistent names	Very High	Rising Fast (FOSSA, 2025)	Yes

AI Code Generation’s Impact

• AI code assistants (e.g., GitHub Copilot, ChatGPT, CodeLlama) are increasingly used in software development, and their hallucinations are persistent and repeatable.
• According to FOSSA, roughly 20% of generated code samples from various AI coding models included at least one recommended package that didn’t actually exist. Crucially, these aren’t all random one-offs—a majority of the fake names recurred frequently. Over 58% of hallucinated package names re-appeared in multiple runs, and 43% showed up consistently across ten different attempts with the same prompt (FOSSA, 2025).
• The risk is amplified by the trust developers place in AI-generated code and the speed at which hallucinated names can be registered by attackers.

Lessons Learned from Documented Incidents

• Persistence and Repeatability: Hallucinated package names are not random; 43% of hallucinations reappeared in 10 successive AI runs, making them reliable targets for attackers (Stripe OLT, 2025).
• Semantic Similarity: Hallucinated names often mimic legitimate packages, increasing the likelihood of developer trust.
• Proof-of-Concepts and Minor Incidents: While no major in-the-wild slopsquatting campaigns have been confirmed, academic demonstrations and minor incidents (e.g., malicious npm packages) validate the risk.
• Industry Warnings: Security vendors and researchers are increasingly warning about the potential for slopsquatting to become a major attack vector as AI adoption accelerates.

Detection and Mitigation Strategies

• Proactive Measures:
  • Use internal proxies for all external package requests to centralize scanning, logging, and validation.
  • Explicitly specify legitimate package names in prompts or code generation workflows.
  • Instruct AI models to verify package legitimacy before suggesting imports.
  • Fine-tune AI models with curated lists of known legitimate packages.
• Automated Scanning: Employ dependency scanners and runtime monitoring tools to detect and block suspicious or unverified packages (FOSSA, 2025).
• Human Oversight: Regularly review AI-generated code and dependencies, especially in critical or production environments.
• Vendor Recommendations: Employ dedicated tools to identify and mitigate malicious or suspicious open-source dependencies. Solutions like Endor Labs, Checkmarx, and Socket offer visibility into risky packages and help detect malicious behaviours early in the development lifecycle (Stripe OLT, 2025).

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Recommendations, Actions and Next Steps

1. Deploy Automated Dependency Scanning and Real-Time Monitoring for Hallucinated Packages

   • Integrate advanced dependency scanning tools (e.g., Socket, Endor Labs, Checkmarx) into CI/CD pipelines to automatically detect, block, and alert on suspicious or unverified packages, including those with names not found in official registries.
   • Implement real-time monitoring of public package registries for new registrations that match AI-hallucinated or frequently repeated package names, leveraging the 43% repeatability rate of hallucinated names as a prioritization metric (Socket, 2025).
   • Expected impact: Proactively prevents slopsquatting attacks by stopping the introduction of malicious, AI-hallucinated packages before they reach production, and enables rapid response to emerging threats.
   • Potential challenges: Requires integration with existing development workflows, tuning to reduce false positives, and ongoing maintenance as new AI models and package names emerge.
   • Metrics for success: Number of hallucinated package installation attempts blocked, time to detection of new suspicious package registrations, reduction in unverified package usage.
   • MITRE ATT&CK IDs: T1195 (Supply Chain Compromise), T1059 (Command and Scripting Interpreter).

2. Establish AI Prompt Safeguards and Collaborate with AI Tool Vendors for Model Hardening

   • Fine-tune AI code generation tools (e.g., Copilot, ChatGPT, CodeLlama) with curated allowlists of legitimate packages and configure prompts to require package existence verification before code suggestions are surfaced.
   • Collaborate with AI tool vendors and internal AI/ML teams to implement self-refinement or hallucination detection features, as research shows some models (e.g., GPT-4 Turbo) can internally flag hallucinated packages with over 75% accuracy (Socket, 2025).
   • Expected impact: Reduces the frequency of hallucinated package suggestions, especially in high-risk, high-temperature, or verbose AI model settings, and shifts developer reliance toward validated dependencies.
   • Potential challenges: Requires vendor engagement, technical collaboration, and may limit the flexibility of AI code assistants; ongoing updates needed as new models and packages are released.
   • Metrics for success: Frequency of hallucinated package suggestions in AI-generated code, number of successful vendor collaborations, reduction in developer-reported AI hallucination incidents.
   • MITRE ATT&CK IDs: T1195 (Supply Chain Compromise), T1566 (Phishing for Information).

3. Enhance Developer Training, Awareness, and Incident Response for Slopsquatting

   • Conduct targeted training for developers and DevOps teams on the risks of slopsquatting, emphasizing the repeatability and semantic plausibility of hallucinated package names (e.g., 43% of hallucinated names are repeated across AI runs).
   • Establish clear incident response protocols for suspected slopsquatting events, including rapid investigation, package quarantine, and communication with affected stakeholders.
   • Expected impact: Increases organizational resilience by empowering developers to recognize and report suspicious dependencies, and ensures rapid containment and remediation of slopsquatting incidents.
   • Potential challenges: Sustaining engagement and awareness, allocating time for training, and ensuring incident response protocols are regularly updated and tested.
   • Metrics for success: Number of developers trained, frequency of slopsquatting incidents reported and resolved, time to containment and remediation.
   • MITRE ATT&CK IDs: T1204 (User Execution), T1598 (Phishing for Information).

Suggested Pivots

1. How do specific AI code generation models such as GPT-4, GitHub Copilot, and CodeLlama compare in their rates and patterns of hallucinating non-existent package names, and what fine-tuning or hallucination detection algorithms have proven most effective in reducing slopsquatting risks within these models?
   Justification: Given the 20% prevalence of hallucinated packages and the 43% repeatability rate across AI runs, understanding model-specific vulnerabilities and mitigation techniques is critical for targeted defenses.

2. Which public package repositories—specifically npm, PyPI, and Maven—are most frequently targeted by slopsquatting attacks, and what automated monitoring techniques (e.g., anomaly detection, semantic similarity analysis, registration timing patterns) provide the highest accuracy and timeliness in detecting malicious registrations? How can these detection systems be integrated into CI/CD pipelines for real-time prevention?
   Justification: Attackers exploit rapid registration of hallucinated names in these repositories; thus, repository-specific detection strategies are essential to prevent supply chain compromise.

3. What organizational behaviors, developer practices, and policy frameworks have been shown in case studies or behavioral research to influence susceptibility to slopsquatting attacks, and what targeted training programs or cultural interventions most effectively reduce blind trust in AI-generated code dependencies?
   Justification: Since developer trust in AI-generated code is a key enabler of slopsquatting, understanding and shaping human factors is vital for comprehensive risk mitigation.

Forecast

Short-Term Forecast (3-6 months)

Slopsquatting will increasingly target high-adoption AI-assisted development ecosystems, with npm (JavaScript) and PyPI (Python) as primary battlegrounds due to their dominant usage and rapid growth driven by AI code generation tools. JavaScript (npm) accounted for 4.5 trillion package requests in 2024, and Python (PyPI) is growing at 80% year-over-year, presenting the largest attack surface. Sectors heavily reliant on these languages and rapid development cycles—such as fintech, healthcare, and cloud services—will be most vulnerable, as they often integrate AI coding assistants like GitHub Copilot and ChatGPT into their workflows.

Attackers will leverage the high repeatability (43%) and semantic plausibility of hallucinated package names to automate the discovery and registration of these packages, exploiting the trust developers place in AI-generated code. Early-stage slopsquatting incidents, such as the malicious npm package @async-mutex/mutex, will become more frequent and diverse, with attackers embedding payloads for credential theft, cryptomining, or backdoors.

Organizations that fail to implement automated dependency scanning in CI/CD pipelines, enforce allowlists, and educate developers on AI hallucination risks will face elevated exposure. AI tool vendors will begin collaborating with security teams to fine-tune models and reduce hallucination rates, but adoption will be uneven.

Examples

• Sonatype’s 2024 report highlights npm and PyPI as the largest and fastest-growing ecosystems, with npm requests growing 70% year-over-year and PyPI 80% year-over-year, driven largely by AI and cloud adoption.
• The January 2025 malicious npm package @async-mutex/mutex incident demonstrates early exploitation of AI-hallucinated package names.
• Research shows GPT-4 Turbo’s hallucination rate as low as 3.59%, indicating that model tuning can reduce but not eliminate hallucinations.
• Fintech and healthcare sectors’ rapid adoption of AI-assisted development tools and heavy use of JavaScript and Python increase their risk profile.

What to Watch Out For

• Surge in registrations of AI-hallucinated package names in npm and PyPI, especially those semantically similar to popular packages.
• Reports of supply chain compromises or alerts from dependency scanning tools integrated into CI/CD pipelines.
• Developer feedback or security advisories highlighting suspicious AI-generated package suggestions.
• Announcements from AI tool vendors about model fine-tuning or hallucination detection features.
• Uptake of allowlisting, internal proxying, and code signing in package management workflows.

Long-Term Forecast (12-24 months)

Slopsquatting will evolve into a highly automated and sophisticated attack vector, with threat actors employing advanced LLMs to systematically generate, predict, and register hallucinated package names at scale. This automation will enable attackers to preemptively claim high-value hallucinated dependencies before developers encounter them, increasing the likelihood of widespread supply chain compromise.

Attackers will also blend slopsquatting with other supply chain attack techniques such as dependency confusion and typosquatting, creating hybrid campaigns that complicate detection and mitigation. These campaigns may incorporate social engineering and credential theft to deepen compromise, targeting critical infrastructure sectors including finance, healthcare, and government.

In response, AI code generation vendors will embed hallucination detection and self-refinement capabilities into their models, potentially achieving over 75% accuracy in flagging hallucinated packages. Regulatory bodies and industry standards organizations are likely to introduce compliance requirements addressing AI-assisted software development risks, analogous to the regulatory responses following SolarWinds and dependency confusion incidents. This will drive widespread adoption of secure SDLC practices incorporating AI risk management, continuous dependency auditing, and developer training.

Despite these advances, attackers will adapt by exploiting new AI models and shifting tactics, maintaining slopsquatting as a persistent and evolving threat.

Examples

• Academic research demonstrates LLMs’ ability to detect their own hallucinations with over 75% accuracy, enabling future model hardening.
• Regulatory frameworks emerging post-SolarWinds and dependency confusion incidents, such as NIST and CISA guidelines, are likely to extend to AI-assisted development risks.
• Hybrid supply chain attacks combining slopsquatting with dependency confusion and typosquatting increase attack complexity.
• Industry-wide adoption of SBOMs, code signing, allowlists, and internal proxies as standard mitigations.
• Increased attacker use of social engineering and credential theft in conjunction with slopsquatting to maximize impact.

What to Watch Out For

• Release and adoption of AI code generation models with integrated hallucination detection and package verification.
• Publication of regulatory guidance or standards explicitly addressing AI-generated code risks in software supply chains.
• Emergence of hybrid supply chain attack campaigns combining slopsquatting with other techniques.
• Increased sophistication and diversity of malicious payloads delivered via slopsquatting packages.
• Widespread integration of AI risk management and dependency auditing into enterprise SDLC and DevSecOps pipelines.

MITRE ATT&CK IDs

T1195, T1195.002, T1474.001, TA0001, TA0005, TA0006, T1204, T1566, T1598, S0632

Appendix

References

1. (2025-04-21) - Slopsquatting: AI Hallucinations and the New Software Supply Chain Risk - FOSSA
2. (2025-05-22) - The Slopsquatting Trap: How AI Mistakes Are Weaponized by Hackers - Stripe OLT
3. (2025-06-12) - The Rise of Slopsquatting: A New Software Supply Chain Threat - Versa Networks
4. (2024-09-01) - State of the Software Supply Chain - Sonatype
5. (2021-02-16) - Dependency Confusion: Understanding and Preventing Attacks - FOSSA
6. (2025-04-08) - The Rise of Slopsquatting: How AI Hallucinations Are Fueling a New Class of Supply Chain Attacks - Socket
7. (2025-07-16) - Slopsquatting: AI's Contribution to Supply Chain Attacks - HackerOne
8. (2025-06-12) - Make No Mistake — Software Is a Supply Chain, And It's Under Attack - Forrester
9. (2023-12-15) - CISA Information and Communications Technology Supply Chain Security

AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this:

what the efff is slopsquatting????

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

MITRE ATTACK

Techniques

1. T1195 (Supply Chain Compromise)

   • Slopsquatting is a direct form of supply chain compromise, where adversaries register and distribute malicious packages hallucinated by AI code generation tools. FOSSA’s research states: “Slopsquatting is a new variant of software supply chain attack where malicious actors capitalize on AI-generated phantom dependencies.” (FOSSA, 2025)
   • Supply Chain Compromise, Technique T1195 - MITRE ATT&CK®

2. T1195.002 (Compromise Software Supply Chain)

   • This sub-technique addresses the manipulation of application software (such as open-source packages) prior to receipt by the consumer. Slopsquatting exploits this by registering hallucinated package names and uploading malicious code, as documented by Stripe OLT: “Attackers monitor these hallucinated package names, register them in public package registries, and upload malicious code under those names.” (Stripe OLT, 2025)
   • Compromise Software Supply Chain, Sub-technique T1195.002 - MITRE ATT&CK®

3. T1474.001 (Compromise Software Dependencies and Development Tools)

   • Adversaries target open-source dependencies and development tools, adding malicious code to widely used packages. Slopsquatting leverages AI-generated package names to introduce these dependencies, as described by Socket: “Attackers exploit rapid registration of hallucinated names in these repositories.” (Socket, 2025)
   • Compromise Software Dependencies and Development Tools, Sub-technique T1474.001 - MITRE ATT&CK®

Tactics

1. TA0001 (Initial Access)

   • Slopsquatting provides adversaries with an initial access vector by tricking developers or automated systems into importing malicious, AI-hallucinated packages. FOSSA notes that “20% of 576,000 AI-generated Python and JavaScript code samples included non-existent packages.” (FOSSA, 2025)
   • Initial Access, Tactic TA0001 - MITRE ATT&CK®

2. TA0005 (Defense Evasion)

   • The use of plausible, AI-generated package names helps adversaries evade detection mechanisms that look for common typosquatting or known malicious packages. The product highlights that “43% of hallucinated package names are consistently repeated across multiple AI runs,” making them harder to detect using traditional methods. (Stripe OLT, 2025)
   • Defense Evasion, Tactic TA0005 - MITRE ATT&CK®

3. TA0006 (Credential Access)

   • Malicious packages may be designed to steal credentials or sensitive information from compromised development environments. Socket and FOSSA both document incidents where malicious packages exfiltrate secrets or credentials. (Socket, 2025)
   • Credential Access, Tactic TA0006 - MITRE ATT&CK®

Procedures

1. T1195.002 (Compromise Software Supply Chain)

   • Adversaries monitor AI code generation outputs, register hallucinated package names, and upload malicious code to public repositories. This aligns with procedures described in FOSSA and Stripe OLT’s research. (FOSSA, 2025, Stripe OLT, 2025)
   • Compromise Software Supply Chain, Sub-technique T1195.002 - MITRE ATT&CK®

2. T1474.001 (Compromise Software Dependencies and Development Tools)

   • Attackers add malicious code to dependencies or development tools, which are then distributed through public package registries, as seen in slopsquatting incidents. Socket details how attackers leverage AI-generated names to seed malicious dependencies. (Socket, 2025)
   • Compromise Software Dependencies and Development Tools, Sub-technique T1474.001 - MITRE ATT&CK®

Software

1. S0632 (Malicious Packages in Public Repositories)
   • Malicious packages uploaded to npm, PyPI, or other public repositories are used as vehicles for slopsquatting attacks, exploiting AI-generated hallucinated names. FOSSA and Socket both document real-world examples of such packages. (FOSSA, 2025, Socket, 2025)
   • Malicious Packages in Public Repositories - MITRE ATT&CK®

Mitigations

1. M1047 (Audit)

   • Regular auditing of dependencies and package sources can help detect and prevent the use of malicious, hallucinated packages introduced via slopsquatting. FOSSA recommends “employing dependency scanners and runtime monitoring tools to detect and block suspicious or unverified packages.” (FOSSA, 2025)
   • Audit, Mitigation M1047 - MITRE ATT&CK®

2. M1045 (Code Signing)

   • Enforcing code signing for packages and dependencies helps ensure the authenticity and integrity of software components, mitigating the risk of slopsquatting. Socket and Stripe OLT both recommend code signing and allowlisting as proactive measures. (Stripe OLT, 2025, Socket, 2025)
   • Code Signing, Mitigation M1045 - MITRE ATT&CK®

3. M1021 (Restrict Web-Based Content)

   • Restricting access to untrusted or unverified package sources reduces the risk of importing malicious, AI-hallucinated packages. FOSSA and Socket both recommend using internal proxies and allowlists to control package sources. (FOSSA, 2025, Socket, 2025)
   • Restrict Web-Based Content, Mitigation M1021 - MITRE ATT&CK®