Blog · Security

Slopsquatting: when your AI assistant installs malware.

AI coding assistants suggest software packages that do not exist. Attackers have noticed, and they are registering the names.

Elvis Chege · 11 October 2026 · 5 minute read

[Draft for Elvis to review and edit before publishing.]

A new way in

Almost every modern application is mostly other people's code. A single npm install or pip install pulls in dozens of packages, each written by someone you have never met. For years the risk was typosquatting: an attacker publishes reqeusts and waits for someone to mistype requests.

AI assistants have opened a new door. Ask one to write code and it will often import a package that sounds right but does not exist. In a study of 16 code-generating language models across 576,000 code samples, researchers found that about one in five of the packages the models recommended did not exist (Spracklen and colleagues, "We Have a Package for You!", 2024).

A name that does not exist is a name anyone can register. If an attacker publishes a malicious package under a name the models keep inventing, the next developer who trusts the suggestion installs it. That is slopsquatting.

The attack does not need a mistake from the developer. It needs a mistake from the model, repeated.

Why it matters here

Teams across East Africa are shipping faster than ever, often small teams leaning on AI to keep up. That is a good thing. But a bank, a SACCO or a government system that installs one poisoned package can leak credentials, customer data or money. Install scripts run with the developer's permissions, on the developer's machine, before any review happens.

Five things to do about it

1. Check that a package is real before you install it. Look at who publishes it, when it was first released and how widely it is used. A package that appeared last week with no history is a warning sign.
2. Pin everything. Commit lockfiles and install from them in CI, so a build never quietly picks up something new.
3. Put a gate in front of the registry. A private registry or proxy with an allow-list means new dependencies are a decision, not an accident.
4. Scan at install time, not just in CI. By the time CI runs, an install script has already run on someone's laptop. This is the idea behind Doria, which won the ITWeb Security Summit Hackathon 2026: it stands in for the package manager and parses each package's code before it touches the disk.
5. Treat AI suggestions like advice from a new colleague. Useful, often right, and always reviewed.

The short version

AI makes engineers faster. It also invents things with confidence. The fix is not to stop using it, but to make sure nothing it invents can reach production without a person, or a tool built for the job, checking first.