As AI coding tools continue to revolutionize software development, a pressing concern has emerged in the cybersecurity community: who is responsible for vetting the code generated by these machines? The answer lies in the scale of open source ingestion, where developer adoption of AI assistants has outpaced traditional security measures. This has created a perfect storm of slopsquatting and supply-chain attacks that threaten to compromise even the most secure pipelines.
Slopsquatting refers to the phenomenon where large language models (LLMs) recommend software libraries based on statistical probability and historical code patterns, rather than real-time package registry verification. When these models suggest a package name that doesn’t exist in public registries, it creates a supply-chain vulnerability known as slopsquatting or AI package hallucination exploitation.
A recent study published at USENIX Security analyzed sixteen popular code-generation models across 500,000+ code samples and found that a measurable percentage of AI-suggested package names do not exist in public registries. Of the suggested dependencies that do resolve to real packages, nearly half contain known CVEs or outdated releases. Attackers are actively monitoring LLM output patterns and developer code repositories to identify these hallucinated package names, which they then register on PyPI or npm with malicious payloads.
The consequences of this vulnerability vector can be devastating. In a recent case, a single hallucinated npm package name (react-codeshift) originating from 47 AI-generated agent skills in a single commit spread organically through forks to over 230 repositories before an engineer noticed that no human had explicitly selected it. The issue was not malicious intent by the developer, but rather a complete absence of ingestion controls.
As AI coding assistants continue to generate software at machine speed, it’s clear that unvetted dependencies expose pipelines to slopsquatting and supply-chain attacks. To mitigate this risk, organizations need to implement secure repository management systems that prove software provenance and build-level attestation while eliminating slopsquatting vectors at the intake step.
The scale of this challenge extends beyond individual enterprises to the broader open source ecosystem. AI assistants generating unvetted dependency suggestions inside enterprise networks are also generating automated pull requests submitted to community-maintained repositories, putting unprecedented strain on human maintainers. Major projects like Kubernetes and the Linux kernel have published diverging policies on AI-assisted contributions, while a recent review of 470 open-source pull requests found that AI-co-authored contributions carried 70% more defects than human-authored code.
To secure this pipeline without slowing down developers or restricting open source, organizations need to govern what enters their environment at the point of selection, before an import ever triggers a build. By implementing secure repository management systems and ingestion controls, enterprises can eliminate slopsquatting vectors and ensure that only clean, built-from-source components enter their pipelines.
In conclusion, as AI coding assistants continue to revolutionize software development, it’s essential for organizations to prioritize the security of their codebase and implement secure repository management systems that prove software provenance and build-level attestation. By doing so, they can eliminate slopsquatting vectors at the intake step and protect themselves from supply-chain attacks.
Source: Bleeping Computer — 2026-08-13