A software engineer at Softjourn, a technology services company headquartered in Silicon Valley, came close to installing a malicious package on a company system after an AI coding assistant recommended it, according to The Register. The package was never installed, but the near miss has drawn attention to a supply-chain risk security researchers call ‘slopsquatting’.
How the near miss happened
The engineer had been using an AI coding agent, a tool that suggests code and software libraries to speed up development. The assistant recommended a package that, on the surface, looked like a normal dependency to add to the project.
Softjourn has a standing policy that requires developers to verify any package an AI tool recommends before installing it. Following that rule, the engineer checked the package’s source code and download history on GitHub, the widely used code-hosting platform. The check revealed two red flags: the package had barely been downloaded, and it had only been created a few days earlier. Legitimate, established libraries typically carry a longer history and far higher usage.
“We caught it because we’d already built a habit of verifying download counts and reviewing source code on GitHub before installing anything an AI rec[ommends].”
What is ‘slopsquatting’?
The case is an example of what security researchers have named slopsquatting: a supply-chain attack that exploits the tendency of AI coding tools to hallucinate, or invent, plausible-sounding software package names that do not actually exist. Attackers monitor for these commonly hallucinated names and register them on public repositories, filling them with malicious code so that unsuspecting developers who follow an AI’s suggestion end up installing malware instead of a real library.
Sergiy Fitsak, Managing Director and Technical Director at Softjourn, explained the mechanism behind the incident. “The problem is that AI models sometimes invent package names that sound plausible but don’t exist, a pattern security researchers have started calling ‘slopsquatting,’” he said, as quoted by The Register.
Had the package been installed, it could have given attackers a backdoor into Softjourn’s systems, potentially allowing data theft or other damage. The exact payload contained in the package in this case was not disclosed.
A wider pattern for AI coding tools
The Softjourn incident is not an isolated concern. Security researchers and vendors, including Endor Labs, Trend Micro, and Mozilla’s 0din research team, have documented slopsquatting and related exploitation techniques as a growing risk across the software supply chain. Package registries such as npm and PyPI, used by millions of developers to distribute open-source code, are the typical targets for attackers exploiting AI hallucinations.
Separately, Mozilla’s 0din researchers showed that AI coding agents, including Anthropic’s Claude Code, could be manipulated into executing malware through a seemingly clean GitHub repository that triggers an automatic setup command once cloned. Taken together, the cases suggest that as AI tools become more embedded in everyday software development, verifying their output before acting on it is becoming as important as writing the code itself.
This article is free to read. It always will be — no paywall, no account, no tracking.
