Slopsquatting
Also called package hallucination
Registering a software package under a name AI models tend to invent, so people who install what the AI suggested get the attacker's code.
AI models sometimes recommend software packages that don't exist, with names that sound exactly like what a library for the job would be called. Ask the same question again and the same invented name often comes back. In one large test of code models, about a fifth of the packages recommended didn't exist.
Attackers noticed. Some ask models for code, collect the invented names, and publish real packages under them with malicious code inside. The next person, or coding agent, to install the suggestion gets the attacker's package.
The name blends "AI slop" with typosquatting, the older trick of registering misspelled names.
For example
A coding agent adds a convincing PDF library to your requirements; it was published a month ago by a stranger, and its install script sends your environment variables to a server.
Put it to use
Where you'll meet slopsquatting in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.