bot네임스페이스 메뚜기 떼: AI가 잠식한 패키지 저장소의 위기
최근 3년간 RubyGems, npm 등 주요 저장소에 200만 개의 신규 패키지가 등록되었으나, 대다수는 AI가 생성한 저품질의 중복 패키지이거나 이름 선점용이다.
Foojay.ioThis article is adapted from The Confidence Trap, part of the "2026 Supply Chain Reckoning" series on my No Regressions newsletter. Your boss calls you on a Friday afternoon. He's read all the available data, he tells you with absolute confidence, and he's decided that migrating from Spring Boot...
#ai #codegeneration #copilot #hallucination #Java #LLM #maven #slopsquatting #softwaresecurity #supplychainsecurity
https://foojay.io/today/why-java-developers-over-trust-ai-dependency-suggestions/
#ai #codegeneration #copilot #hallucination #Java #LLM #maven #slopsquatting #softwaresecurity #supplychainsecurity
https://foojay.io/today/why-java-developers-over-trust-ai-dependency-suggestions/
Hunter Perrin#AI #code often includes references to non-existent dependencies. These references are commonly called “#hallucinations”. A new type of #attack has arisen that involves an attacker registering a package whose name is frequently hallucinated. When AI code containing this #hallucination is accepted, and this dependency is installed, the attacker can ship #malicious code into the project’s build, introducing a major #security vulnerability. This type of attack has become known as “#slopsquatting”.
HabrФантазии LLM воплощаются в реальности — фальшивые опенсорсные библиотеки
LLM придумывает названия несуществующих библиотек и предлагает разработчикам-вайбкодерам пользоваться ими. Если есть спрос — возникнет и предложение. Вскоре эти библиотеки действительно появляются в реальности , но уже с вредоносным кодом.
https://habr.com/ru/companies/globalsign/articles/946872/
#llm #галлюцинации #slopsquatting #генерация_кода #фальшивки
Tomi**Check this out: techno feudalism, chatons, slopsquatting and more (9. 8. 2025)**
- The future is not self-hosted: https://www.drewlyton.com/story/the-future-is-not-self-hosted
(Self-sustainable organic farms (and self-hosted IT stuff) are a nice idea, but they are difficult to maintain in ‘island mode’. Are community owned shared data servers a solution?)
(Examples of community data servers in France)
- Your first FOSS contribution: https://collaboraonline.github.io/post/easyhacks/
(If you’re masochistic enough to join FOSS development and don’t know where to start, well, you can do it here. A list of open issues that are ‘easy’ solvable.)
- Slopsquatting: https://en.wikipedia.org/wiki/Slopsquatting
(If you’re using LLM for code generation and then you install a non-existing library (that is hosted by the attacker), well, it’s your own fault.)
- Home Assistant and 433Mhz devices: https://www.wswapps.com/books/home-assistant/page/433-mhz-devices
(You want to see what are your neighbours’ devices, like garage opener, up to? )
- Nice fonts – 7 and 14-segment display: https://www.keshikan.net/fonts-e.html
(You never know when you need retro-style display fonts)
- Replace your Windows 10 with Linux, https://endof10.org/
(Windows 10 support is running out soon. Don’t buy a new computer, shoot yourself in the foot with a Linux! You will limp, but you’ll be free from mass-scale espionage.)
- How to detect AI writing: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing
(Forget AI detector tools, hoomanz are also able to detect AI slop. Actually, the signs of slop are pretty straight forward. AI sounds like you listened to a hyped ultra positive grifter salesman/politician)
https://blog.rozman.info/check-this-out-techno-feudalism-chatons-slopsquatting-and-more-9-8-2025/
Glyn Moody#Slopsquatting: nabbing nonexistent names AI chatbots likely to hallucinate - https://boingboing.net/2025/08/06/slopsquatting-nabbing-nonexistent-names-ai-chatbots-likely-to-hallucinate.html
Karl Voit 
"#Slopsquatting is a type of #cybersquatting. It is the practice of registering a non-existent software package name that a large language model (#LLM) may hallucinate in its output, whereby someone unknowingly may copy-paste and install the #software package without realizing it is #fake."
trusty falxter 🧠
Ok, ich lass mich mal zu einer #Prophezeiung hinreißen.
#Slopsquatting ist ja ein alter Hut.
Aber was haltet ihr von #Slopswatting? Also das gezielte Platzieren von Falschinfos im Internet, sodass AI-aided Policing-Systeme kunkludieren, dass eine bestimmte Person ein ganz gefährlicher Gefährder ist, den man mal hochnehmen sollte?
Benjamin Carr, Ph.D. 👨🏻💻🧬#LLM can't stop making up software dependencies and sabotaging everything
Hallucinated package names fuel '#slopsquatting'
As #AI #coding assistants invent nonexistent software libraries to download and use, enterprising attackers create and upload libraries with those names—laced with #malware, of course.
https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/
Hallucinated package names fuel '#slopsquatting'
As #AI #coding assistants invent nonexistent software libraries to download and use, enterprising attackers create and upload libraries with those names—laced with #malware, of course.
https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/
Lothar Schulz📢 AI coding tools are creating silent vulnerabilities through "slopsquatting"—where attackers register package names hallucinated by AI.
This attack vector “exploits vibecoding" (using AI without review) and specifically targets less technical developers.
#AISecurityRisks #Slopsquatting #VibeCoding #SecureCoding #CyberSecurity
