endorlabs.comarticleSlopsquatting: When AI Agents Hallucinate Malicious Packages | Blog | Endor Labs
Endor Labs explains slopsquatting, the supply-chain attack where AI coding assistants (Cursor, GitHub Copilot, Claude) hallucinate plausible but nonexistent package names, which attackers then pre-register on npm/PyPI with malicious post-install scripts that exfiltrate cloud and Git credentials. The piece walks through why LLMs recurrently hallucinate the same names, a worked fastparse-xyz example showing the install-to-CI/CD chain, and defenses: provenance verification, dependency firewalls, SCA with reachability analysis, sandboxed installs, and agent policy controls like private registries and human approval gates.
TL;DR AI coding agents invent fake package names that attackers pre-register with malware, and this vendor writeup breaks down the attack chain and defenses.
Technologies named here
Techniques named here
- Slopsquatting
- Typosquatting
- Post-install script credential exfiltration
- Supply chain persistence via lockfile and CI/CD
- Hallucination harvesting
Related in Supply Chain
