Phase 6: Supply Chain Security & Slopsquatting · 50 min · Python · pip · npm

The Slopsquatting Attack Vector

19.7% of AI-recommended packages don't exist. Attackers register them and wait.

Real-world application: Engineers who can explain the slopsquatting attack vector and cite the 19.7% hallucination rate demonstrate awareness of AI-specific supply chain risks.

What you will learn

Explain the slopsquatting attack vector: AI hallucinates package names, attackers register them
Cite the USENIX 2025 study: 16 models, 576,000 code samples, 19.7% hallucination rate
Understand open-source vs commercial model hallucination rates (21.7% vs 5.2%)
Explain the react-codeshift propagation incident and the unused-imports npm malicious package

Introduction

The Slopsquatting Attack Vector

Objective

Run the slopsquatting attack simulation with 1000 AI package recommendations from open-source and commercial models. Observe the 19.7% hallucination rate, attacker registration, developer installation, and propagation across repositories.

19.7% of AI-recommended packages don't exist. Attackers register them and wait.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Problem, The Concept, Build, Check Yourself, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account — the opening phases of 29 of 35 courses are free, no credit card.