slopsquatting
PulseAugur coverage of slopsquatting — every cluster mentioning slopsquatting across labs, papers, and developer communities, ranked by signal.
-
Slopsquatting detector flaws revealed, exceptions removed
A slopsquatting detector for software packages has been found to have significant flaws in its detection methods. The detector initially relied on package age, but exceptions were added for factors like signed build sta…
-
AI assistants hallucinate package names, creating malware risk
An AI coding assistant recommended a non-existent package name to an engineer, a phenomenon known as "slopsquatting." The engineer narrowly avoided installing malware because they manually reviewed the package's registr…
-
New AI Agent Attacks Exploit Unverified Names
Security researcher Warden described three new types of "squatting" attacks that exploit the trust AI agents place in unverified names. These attacks, termed Slopsquatting, Phantomsquatting, and HalluSquatting, target f…
-
AI models invent identical fake package names, risking developer security
Recent research indicates that leading AI models are generating identical, fabricated package names for popular software repositories like PyPI and npm. This phenomenon, known as slopsquatting, poses a significant secur…