Top AIs invent same fake PyPl and npm package names
Summary
AI coding tools are consistently hallucinating the existence of non-existent software packages, creating a new threat known as slopsquatting. Researchers found that multiple top LLMs generated the same fake package names, with many of these names still available for registration on PyPI and npm. While no malicious activity has been confirmed yet, this trend poses a risk to developers incorporating these hallucinated names into their projects.
IFF Assessment
The article highlights a new attack vector where AI hallucinations can lead to the creation of malicious software packages, directly threatening software supply chain security.
Defender Context
Developers need to be vigilant about validating package names suggested by AI coding assistants, as these tools can invent non-existent libraries that attackers can then register maliciously. Organizations should implement stricter code review processes and software supply chain security measures to mitigate the risk of slopsquatting attacks.