AI Code Suggestions Are Sabotaging the Software Supply Chain

We’ve hit a worrying inflection point in the software development world. AI powered coding tools, which many developers now treat as second nature, are inadvertently generating ghost package names, opening the door to serious supply chain attacks. According to a new report in The Register, these so called "hallucinated dependencies" aren’t just harmless errors. Malicious actors are actively registering these fake packages, a practice now coined slopsquatting, and slipping malware into developer workflows.

From a security standpoint, it’s maddening. These packages can look deceptively legitimate, complete with polished READMEs, faux GitHub repos, and even AI generated summaries from Google itself singing their praises. We’re essentially watching AI rubber stamp malware written by other AIs. It’s typosquatting on steroids, and it’s scaling fast.

As someone with a background in cybersecurity and software engineering, I can’t stress enough how important it is for developers to slow down and verify every dependency. Don’t blindly copy and paste from your AI assistant. These tools can be helpful, but they’re not infallible, and when it comes to your software supply chain, the stakes are far too high.

Read the full article on The Register here.