Typosquatting was a spellcheck issue. Slopsquatting is a trust issue. | vlt /vōlt/<br>svg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground group w-fit rounded-sm px-3" href="/blog/slopsquatting-trust-problem">Typosquatting was a spellcheck issue. Slopsquatting is a trust issue.<br>svg]:px-2.5 rounded-sm" href="/sign-up">Sign Upsvg]:px-2.5 rounded-sm" href="/sign-in">Log In<br>Menusvg]:px-2.5 rounded-sm text-muted-foreground" href="/blog">All Posts<br>svg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground bg-background rounded-sm capitalize">registrysvg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground bg-background rounded-sm capitalize">securitysvg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground bg-background rounded-sm capitalize">packages<br>Typosquatting was a spellcheck issue. Slopsquatting is a trust issue.<br>Consuming JavaScript packages safely just got more complicated.

Jen ChanJen Chan

July 30, 2026

For years, the classic npm name attack was a spelling prank: someone registered<br>expres and waited for you to fat-finger express, or lodahs and hoped<br>you'd miss the swap. The remedy was to read more carefully. Today, code is generated faster than anyone can verify every dependency it installs.

Typosquats and slopsquats belong to a broader category of package confusion attacks: packages deliberately named to look legitimate, delivering corrupted or malicious code instead of what you expected.

In the cultural memory of JavaScript maintainers, the cross-env incident was a moment of alarm. "HackTask"'s package mimicked cross-env but included a package-setup.js script that base64-encoded environment variables and POSTed them to npm.hacktask.net.1 It was one of 38 packages posing as popular libraries that went undetected for two weeks.2 Once reported, npm removed them and banned the account within hours, then months later shipped package moniker rules blocking names that are punctuation variants of existing packages.

The stakes keep compounding as attackers exploit gaps between toolchains and publishing environments, and developers lean on AI to deliver more. In February 2026, the Sandworm_Mode campaign seeded npm with 19 typosquatted packages posing as popular utils, crypto tools, and AI coding tools.3 The payload harvested npm and GitHub CI credentials to propagate and planted a rogue MCP server that used prompt injection to turn AI coding assistants into exfiltration channels. npm quietly removed all 19 packages.3

Typosquats aren't limited to registry installs; they also show up as tooling<br>sites on official-sounding domains. On July 24, 2026, a fake corepack<br>reappeared at corepack.org, serving an infostealer and proxyware to developers<br>looking for a download.4

Slopsquatting: AI-invented package names

"Figure 1: Exploiting Package Hallucination," from Spracklen et al., "We Have a Package for You!<br>A Comprehensive Analysis of Package Hallucinations by Code Generating<br>LLMs," 34th USENIX Security<br>Symposium, p. 3690.

In April 2025, Python Software Foundation security developer-in-residence Seth Larson<br>coined the term "slopsquatting",5 later popularized by Ecosyste.ms'<br>Andrew Nesbitt. Instead of betting you'll mistype a real name, attackers pre-register a name an AI coding assistant might invent .

When your AI assistant confidently writes an import for a plausible-sounding<br>library and you approve the install, an attacker who registered that<br>hallucinated name gets to run code on your machine. You never made a mistake.<br>The model did, and you trusted it.

In 2025, the peer-reviewed USENIX Security paper "We Have a Package for You!"6 ran 16 LLMs over 576,000 code samples. For JavaScript, 21.3%<br>of the packages they recommended didn't exist .7 GPT-4 Turbo, a leading<br>commercial model at the time, invented a nonexistent npm package about 4%<br>of the time; open-source models (CodeLlama 7B and 34B) did so in more than a<br>third of suggestions.8

The same study found hallucinations are neither random nor obvious: repeating a<br>prompt resurfaces the same invented names, and most are not near-misses of real<br>packages but semantically plausible names that never existed.9 A<br>hallucination you can reproduce is a target an attacker can pre-register.

Newer models have narrowed the gap: an independent 2026 replication of<br>Spracklen's approach puts frontier-model hallucination rates at 2.62-3.78%<br>for JavaScript.10 As its title says, the range shrinks but the<br>threat remains: an attacker needs one reproducible name, and twelve of the<br>hallucinated npm names the author collected were still free to<br>register.11

When AI-scale codegen upends line-by-line review, telling developers to watch what they type, or what installs mid-agentic-loop, is neither reasonable nor effective.

Slopsquatting is already in the wild:...