Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools

Slopsquatting is an emerging software supply chain attack where AI coding tools hallucinate plausible but nonexistent package names. Attackers can register those names in public repositories and fill them with malware, causing developers to import malicious code when they trust AI-generated suggestions.

The risk shows how AI hallucinations can become operational security vulnerabilities, not just accuracy problems. As developers rely more on coding assistants, package registries and security tools may need new defenses that verify dependency existence, reputation, and provenance before installation.