Blog

What the bots shipped

Research notes and postmortems on the failure modes of AI-generated code.

September 8, 2026 · slopsquatting · supply-chain · packages

Slopsquatting explained: how hallucinated npm packages become malware

LLMs invent package names; attackers register them. What package hallucination is, the research behind it, and how to block the install path at PR time.