ExternalSoftware Engineering
DZone
Slopsquatting: A New Supply Chain Threat From AI Coding Agents
A new supply chain attack class is targeting the layer below your code: the dependencies your AI coding agent suggests. Researchers call it slopsquatting. It works because AI tools, even the good ones, hallucinate package names. Attackers do not need to compromise a real package anymore. They wait for a model to invent one, then register the invented name on a public registry. When your developer runs npm install or pip install, the malware lands. This article covers what slopsquatting is, why i
DZoneRead original