Tagged:

2 posts

• Slopsquatting: When AI Hallucinated Package Names Become a Supply Chain Attack

  LLMs hallucinate package names at rates exceeding 20%. Attackers register those hallucinated names on npm and PyPI with malicious payloads. No typo required — the developer trusts the AI. This post explains the mechanics, documents the evidence, and gives developers concrete defenses.

  Jul 15, 2026 supply-chain llm-security package-security code-generation defense-patterns

• Hallucination as a Security Surface: Package Fabrication, Fake Credentials, and Confident Wrong Advice

  LLM hallucination isn't just a reliability problem — it's an attack surface. Fabricated package names, fake credentials, and wrong security advice create real, exploitable gaps.

  Jul 4, 2026 hallucination supply-chain code-generation llm-security defenses