Slopsquatting: How LLMs Create New Supply Chain Security Threats

This Habr article explores 'slopsquatting,' a emerging cybersecurity threat linked to the use of Large Language Models (LLMs) in software development. Despite years of community efforts to teach developers caution when selecting third-party dependencies, LLMs frequently hallucinate, suggesting non-existent libraries. Attackers exploit this by registering such packages in repositories under names recommended by the AI. The article analyzes the frequency of these hallucinations and proposes defense methods against supply chain poisoning attacks fueled by over-reliance on AI tools. The author emphasizes that automated code generation requires a shift in security practices, as developers tend to blindly trust model recommendations, creating significant opportunities for injecting malicious code into popular projects.