AI coding assistants generate code and suggest dependencies at machine speed, often recommending package names that do not exist or are outdated and vulnerable. This phenomenon, called slopsquatting or AI package hallucination exploitation, allows attackers to pre-register these hallucinated package names on public registries like PyPI or npm and upload malicious payloads. When automated developer environments or CI/CD pipelines fetch these packages, builds become compromised. A USENIX Security study showed a measurable percentage of AI-suggested packages are hallucinated or vulnerable. Early 2026 incidents tracked a hallucinated npm package spreading across hundreds of repositories before detection. Traditional post-commit scanning tools struggle to keep pace with this velocity, necessitating governance at the point of package selection. Mitigations include blocking direct registry queries by AI agents, sandboxing new dependencies for automated analysis, and using curated ingestion gateways to pre-vet packages. ActiveState’s Secure Open Source Library exemplifies such a solution, reducing exposure to slopsquatting by about 95%. The challenge extends to open source maintainers who face increased defect density and policy conflicts due to AI-generated contributions. Overall, securing AI-assisted development pipelines requires updated supply chain ingestion rules and proactive governance to prevent automated compromise.

The threat enables attackers to compromise software supply chains by exploiting AI-generated hallucinated package names, leading to malicious code inclusion in builds without explicit human selection. This can result in compromised CI/CD pipelines and downstream propagation of vulnerable or malicious dependencies across multiple repositories. The velocity of AI code generation outpaces traditional security reviews, increasing the risk of supply chain attacks and elevating defect density in open source contributions. Organizations without proper ingestion governance face heightened exposure to slopsquatting attacks and associated CVEs, potentially undermining software integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation focuses on proactive governance at the point of package selection rather than post-commit scanning. Recommended actions include blocking direct queries from developer workstations and AI agents to unvetted public package registries, isolating AI-suggested dependencies in sandbox environments for automated vulnerability and reachability analysis, and employing curated ingestion gateways that pre-vet packages against known malicious typosquats and slopsquatting targets. Using solutions like ActiveState’s Secure Open Source Library can reduce exposure to slopsquatting vectors by approximately 95% without hindering developer productivity. Organizations should update supply chain ingestion policies to govern AI-assisted code generation effectively.