Slopsquatting

A year or so ago I was frustrated when GitHub Copilot generated some code that included references to libraries that simply did not exist.

It turns out that security researchers and malicious actors have picked up on this variety of AI hallucination, so a library can be set up at the location that was produced and cause code to be brought into developers’ (or these days, non-developers) systems and introduce undesirable functionality.

I only heard about the expression on a podcast relatively recently, but it seems the world is running to a faster timeline these days so it came up in an article on TheRegister a couple of days ago.

The alarming aspect of the examples mentioned is that the malicious code exfiltrates credentials without the exploited project even needing to be executed due to npm’s preinstall hooks.

Be careful folks…