Full Report
Fortunately, the company had a policy of checking source code on GitHub first
Analysis Summary
# Incident Report: AI "Slopsquatting" Supply Chain Near-Miss
## Executive Summary
A software engineer at Softjourn narrowly avoided a supply chain compromise after an AI coding assistant recommended a malicious library name. The engineer discovered that attackers had preemptively registered a "hallucinated" package name with a malicious payload, but the threat was neutralized due to a mandatory manual code review policy.
## Incident Details
- **Discovery Date:** Approximately August 2026 (based on publication)
- **Incident Date:** Not specified; prior to August 20, 2026
- **Affected Organization:** Softjourn
- **Sector:** Software Development and Consulting
- **Geography:** International (Managed by Sergiy Fitsak)
## Timeline of Events
### Initial Access
- **Date/Time:** During a routine development task.
- **Vector:** AI Agent Hallucination / Dependency Confusion.
- **Details:** An engineer requested a package recommendation from an AI agent for a common task. The AI suggested a plausible but non-existent package name.
### Lateral Movement
- **N/A:** The attack was intercepted before the initial execution.
### Data Exfiltration/Impact
- **N/A:** No data was breached. Potential impact included backdoors and data theft.
### Detection & Response
- **Detection:** The engineer followed company policy to verify source code and package metadata on GitHub before installation.
- **Response Actions:** The engineer identified the package as suspicious (low download count, recently created), aborted the installation, and reported the finding internally.
## Attack Methodology
- **Initial Access:** Slopsquatting (registering malicious packages under names frequently hallucinated by LLMs).
- **Persistence:** Potential backdoor (if installation had succeeded).
- **Defense Evasion:** Using legitimate-sounding names that mimic standard naming conventions of established libraries.
- **Discovery:** AI model reconnaissance (attackers identify common hallucination patterns).
- **Lateral Movement:** N/A (prevented).
- **Impact:** Supply chain compromise and potential system takeover.
## Impact Assessment
- **Financial:** None (prevented).
- **Data Breach:** None.
- **Operational:** Minor delay in development for verification; prevented major business disruption.
- **Reputational:** Positive; demonstrates the effectiveness of the organization's security posture.
## Indicators of Compromise
- **File indicators:** Newly created package on public repositories (GitHub/NPM/PyPI) with minimal version history.
- **Behavioral indicators:** AI agent recommending non-standard or obscure libraries for routine tasks.
- **Metadata indicators:** Low download counts for a package suggested by an AI as a "standard" solution.
## Response Actions
- **Containment:** Manual intervention by the developer blocked the download.
- **Eradication:** Avoidance of the malicious library.
- **Recovery:** Identification of a legitimate alternative for the development task.
## Lessons Learned
- **AI Hallucinations are a Security Risk:** LLMs cannot be trusted to provide verified external dependencies.
- **The "Slopsquatting" Threat:** Threat actors are actively monitoring AI outputs to register hallucinated names as malicious packages.
- **Policy Works:** Rigid adherence to "check before you install" policies is effective even against modern AI-driven threats.
## Recommendations
- **Human-in-the-Loop:** Maintain a mandatory human review process for any code or dependency suggested by AI.
- **Dependency Whitelisting:** Use internal package mirrors or private registries to prevent the accidental pull of unverified public packages.
- **Vetting Procedures:** Train developers to check package telemetry (age, download count, contributor history) before integration.
- **Software Bill of Materials (SBOM):** Implement SBOM tools to monitor and audit all third-party libraries introduced into the environment.