Notifications
Clear all
Topic starter
19/08/2026 3:32 pm
TL;DR: AI coding assistants are now helping attackers by hallucinating plausible package names that can be registered first, turning fluent model errors into supply chain compromise; USENIX Security 2025 found 19.7% of recommended packages did not exist, with 43% repeating across prompts, according to Xygeni. The governance problem is no longer just package trust but controlling what developers and agents are allowed to install.
NHIMG editorial — based on content published by Xygeni: Slopsquatting and AI-driven package hallucinations in the software supply chain
By the numbers:
- A peer-reviewed USENIX Security 2025 study found that 19.7% of recommended packages did not exist across 576,000 generated code samples.
- The same study found that 43% of fake package names reappeared across repeated prompts, making hallucinated dependencies predictable enough to weaponise.
- A 2023 experiment saw a placeholder package under a hallucinated name downloaded more than 30,000 times in three months.
Questions worth separating out
Q: What breaks when AI-generated package names are allowed to install without review?
A: The main failure is that model output becomes an execution path.
Q: Why do shared credentials create compliance risk for NHI and IAM teams?
A: Shared credentials destroy identity attribution, which means the environment can no longer prove which person or system performed a given action.
Q: How do security teams know if dependency controls are actually working?
A: Look for whether build systems prevent unauthorised version drift, whether package provenance is checked before install, and whether secret-handling code is isolated from broad application reach.
Practitioner guidance
- Verify every AI-suggested dependency before installation Require a human or automated policy check that confirms the package exists, is maintained, and matches an approved source before any install command runs.
- Enforce install-time behavioural screening Score new packages on install hooks, network calls, obfuscation patterns, and other suspicious runtime traits at publish time, then quarantine unknown packages before they reach developer endpoints or CI jobs.
- Inventory AI tools with an AI-BOM Track which coding assistants, agents, and automation chains can introduce dependencies, and bind their registry access to short-lived credentials with explicit policy approval for new package sources.
What's in the full article
Xygeni's full article covers the operational detail this post intentionally leaves for the source:
- The exact slopsquatting attack chain and how hallucinated package names are harvested in practice
- The endpoint and install-time blocking approach used to stop malicious packages before post-install scripts run
- The role of Malware Early Warning verdicts in classifying brand-new packages before signatures exist
- The practical deployment context for developer workstations and build environments
👉 Read Xygeni's analysis of slopsquatting and AI-suggested package risk →
Slopsquatting and AI-suggested packages: what should teams do now?
Explore further
19/08/2026 4:14 pm
Slopsquatting is a governance failure, not just a malware problem. The core issue is that AI-generated dependency advice is being treated as though it were a validated software control. That assumption breaks the normal supply chain model because the package name is created outside the registry and only becomes dangerous once human or agentic trust converts it into execution. Practitioners should read this as a dependency-governance problem that spans AI tooling, developer endpoints, CI/CD, and registry policy.
A question worth separating out:
Q: Who is accountable when an AI agent or automation system installs a malicious dependency?
A: The accountable team is the one that granted autonomous execution without a policy boundary. If a bot or AI agent can install third-party code, the organisation has created a delegated trust chain and should govern it like any other privileged non-human identity. Accountability sits with platform owners, security governance, and the workflow owner together.
👉 Read our full editorial: Slopsquatting exposes a new software supply chain risk for AI coding
