Slopsquatting: attackers register LLM-hallucinated package names within hours
Thionne_WTZ · x · 2026-10-13
LLM code hallucinations often produce nonexistent package names, and attackers register them within hours (slopsquatting). The author saw AI-generated code pull a nonexistent npm package that went live and malicious 12 hours later. The fix isn't just reviewing PRs — treat every new dependency as untrusted until you've verified the publisher, package age, and actual code. Most teams still don't.
More from coding & agent
- Spidermonkey trims 10% agent steps on weak models, no gain on strong ones — mathemagic1an · 2026-10-14
- Hankweave: open-source framework for recursive self-optimization under $1000 — hrishioa · 2026-10-14
- Replicas raises $4M seed for harness-agnostic cloud agents, backed by YC and Paul Graham — KlausCodes · 2026-10-14
- Wrapper vs harness: will the next model release help you or kill you? — MartinGTobias · 2026-10-14
- OpenAI launches FDE livestream series on enterprise AI deployment — BorisMPower · 2026-10-14
- exe.dev's durable sandboxes win over devs: SSH in as root, plus Shelley coding agent — davidcrawshaw · 2026-10-14