Slopsquatting: How My AI Coding Assistant Secretly Tried to Poison My Supply Chain

Like most developers, I use AI coding assistants daily to speed up my workflow. Recently, while asking a model to help me with my project, it suggested a package that did not exist. That got me thinking: if it happened to me, who else is blindly copy-pasting these hallucinated packages? When I started digging into how these tools actually resolve package names, I found something unsettling.

These models generate code based on probability, not by checking real package registries. So they frequently invent logical-sounding but completely fake package names. A well-documented example is models regularly recommending 'huggingface-cli', when the actual legitimate library is'huggingface_hub[cli]' . Attackers can easily map out these consistent AI mistakes and pre-registering those exact fake names on PyPI and npm with malicious payloads. This attack class is known as Slopsquatting (Hallucination Squatting).

What makes this significantly worse is the rise of autonomous coding agents. Unlike human developer who might pause to verify a package, these agents install dependencies as part of their workflow with no confirmation step. The hallucination-to-compromise pipeline becomes fully automated, and the blast radius grows with every agent that trusts its own output.

This talk is a developer-to-developer look into how these phantom dependencies easily bypass traditional static security scanners. We will look at real-world data from the huggingface-cli incident, where a single hallucinated package was mistakenly added to a major public repository and downloaded over 30,000 times by unsuspecting engineering teams. We will also look at how open-source tooling like pip-audit and lightweight CI registry verification hooks can be used to catch hallucinated dependencies before they reach production.

This session is built for independent builders and maintainers who want to keep using modern developer tools without accidentally compromising their software supply chains.

1. A clear understanding of how daily reliance on AI tools silently introduces new risks to your software supply chain.
2. Insights from the huggingface-cli incident on how easily fake, AI-generated dependencies slip into public repositories.
3. Practical ideas on how to build simple, automated checklines that verify code imports against live package registries before deployment.