The rapid adoption of AI coding assistants by developers is introducing new supply chain vulnerabilities, particularly through a mechanism dubbed "slopsquatting" or AI package hallucination exploitation. This issue arises when large language models (LLMs) suggest non-existent or malicious software package names, which can then be registered by attackers and subsequently fetched into development pipelines.
Security researchers and industry experts have observed that AI coding tools, while boosting productivity, recommend software libraries based on statistical probability rather than real-time verification against package registries like PyPI or npm. A study analyzing 16 popular code-generation models across over 500,000 code samples found that a measurable percentage of AI-suggested package names do not exist in public registries. Furthermore, nearly half of the suggested dependencies that do resolve to real packages contain known Common Vulnerabilities and Exposures (CVEs) or are outdated.
Attackers are actively exploiting this vulnerability by monitoring public LLM outputs and developer code repositories to identify these hallucinated package names. Once identified, an adversary can register the dummy name on a public registry and upload a malicious payload. Automated developer environments or CI/CD pipelines then fetch these packages, leading to compromised builds. This vector has been observed in real-world deployments; for instance, early in 2026, a single hallucinated npm package name, `react-codeshift`, originating from 47 AI-generated agent skills in one commit, spread organically through forks to over 230 repositories before it was identified as never having been explicitly selected by a human.
The challenge extends beyond direct malicious exploitation. The sheer volume of AI-generated code and dependency suggestions is overwhelming traditional software composition analysis (SCA) tools, which typically scan code post-commit. This reactive approach is proving insufficient against machine-speed code generation. The issue is compounded by the fact that AI-co-authored contributions have been found to carry a higher defect density, with one review of 470 open-source pull requests indicating 70% more defects than human-authored code, even when appearing clean on the surface.
This influx of AI-generated content also strains open-source maintainers. Projects like Kubernetes, the Linux kernel, LLVM, and Godot have implemented varying policies on AI-assisted contributions, ranging from outright bans to requiring full human accountability. When hallucinated or vulnerable packages enter corporate ingestion pipelines, they can trickle into upstream open-source pull requests, forcing volunteer maintainers to validate dependencies that no human deliberately evaluated.
Current telemetry indicates a significant gap in security controls for AI-assisted development. While 85% of organizations use AI coding assistants and 38% use AI for pull request-stage code review, only 9% have dedicated AI application security controls. Traditional application security workflows, which rely on scanning code after it's written or after a pull request is opened, generate a backlog of alerts that engineers often ignore when code is generated at machine speed.
To mitigate these risks without hindering developer productivity, security and platform teams are shifting defense "left" of the integrated development environment (IDE). This involves restricting direct registry fetching by developer workstations and AI agents, isolating newly introduced dependencies in sandboxes for automated analysis, and governing the ingestion gateway. The goal is to move from reactive CVE counting to proactive source curation, ensuring that every package recommended by an AI model is pre-vetted against malicious typosquats and slopsquatting targets at the point of selection.
This approach aims to intercept hallucinated package risks at the selection boundary, before they can enter the build process. By implementing a governed ingestion source, organizations can eliminate slopsquatting vectors at the intake step, potentially reducing overall CVE exposure significantly without requiring developers to disable their AI assistants. The core issue is managing the velocity of code generation, not solely the accuracy of AI models.
