Slopsquatting

Slopsquatting is a supply-chain attack in which someone publishes a package under a name that AI coding models tend to invent. When a model suggests a dependency that doesn't exist and someone installs it, they get the attacker's package.

What it is

Code-generating models sometimes import or install packages that were never published. A model can repeat the same invented name across many answers, so an attacker can collect those names and register them on a public registry such as npm or PyPI.

A study accepted to the 2025 USENIX Security Symposium tested 16 code-generating models on 576,000 code samples. On average, at least 5.2% of the packages suggested by commercial models and 21.7% of those suggested by open-source models did not exist, and the authors recorded 205,474 unique invented names (We Have a Package for You!).

Why it matters

Installing a package runs its code, often through install scripts, with the access of whoever runs the install. An agent that adds dependencies without a person looking makes this step easy to miss.

In AI CodeOps

AI CodeOps doesn't look up new package names in a registry. A session's change, including any new line in a manifest, is a diff: the review reads it, and the pull request opens only after a person approves. When the session runs your tests, it installs dependencies in an isolated sandbox, then cuts the sandbox off the network before the tests run.