PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What is Slopsquatting? The AI Package Hallucination Attack Already Happening

aikido.dev | blog | #ai-security | #npm | #llm | #supply-chain-security | #slopsquatting | #typosquatting | #ai-hallucination
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Slopsquatting is typosquatting's AI successor: attackers register package names LLMs hallucinate, waiting for developers to install them on the model's recommendation. It's already happening.
Published
Collected

Related coverage

blog · jfrog.com
Coding Agents Just Reopened Your Software Supply Chain Blind Spot
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · netspi.com
3 Software Supply Chain Risks in 2023
Software supply chain attacks in 2023 cluster into three categories: package manager attacks like dependency confusion and typosquatting, developer compromise, and breaches at large software vendors.
blog · aikido.dev
AI agent security in Kubernetes: Why prompt injection isn't the right term
This post is based on Mackenzie's conversation with Abdel Sghiouar on The Secure Disclosure podcast. Listen to the full episode or watch below.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
Back