Phase 6: Supply Chain Security & Slopsquatting · 50 min · Python · PyPI API · npm API
Detection Signals
1. Registry Verification
The first and simplest check: does the package exist on the registry?
import urllib.request
import json
def verify_package_exists(name, ecosystem="pypi"):
if ecosystem == "pypi":
url = f"https://pypi.org/pypi/{name}/json"
elif ecosystem == "npm":
url = f"https://registry.npmjs.org/{name}"
else:
return False
try:
urllib.request.urlopen(url, timeout=5)
return True
except:
return False
2. Publisher Identity
Check who published the package:
| Signal | Safe | Suspicious |
|---|
| Publisher account age | > 2 years | < 90 days |
| Publisher packages | Multiple established packages | First package |
| Publisher verification | Verified email, 2FA | No verification |
| Publisher name | Recognizable org/user | Random string |
3. Registration Date Analysis
Packages registered < 90 days ago are a red flag:
Package: react-codeshift
Registration date: 2025-01-15
Days since registration: 45
Status: RED FLAG (< 90 days)
4. Levenshtein Distance
Calculate edit distance from popular packages to detect typosquatting:
| Hallucinated Name | Real Package | Levenshtein Distance | Risk |
|---|
reqeusts | requests | 2 (transposition) | High |
python-utils-extra | python-utils | 6 (suffix added) | Medium |
react-codeshift | react-codemod | 4 (similar concept) | Medium |
5. Cross-Ecosystem Conflation
8.7% of hallucinations involve cross-ecosystem confusion -- the AI recommends a package from one ecosystem in another:
AI says: "pip install lodash"
Problem: lodash is an npm package, not a PyPI package
Risk: Attacker registers "lodash" on PyPI with malicious code
The 5-signal verification checklist
Before installing ANY AI-recommended package, check: (1) Does it exist on the registry? (2) Is the publisher established (account > 2 years, multiple packages)? (3) Was it registered > 90 days ago? (4) Is the Levenshtein distance from popular packages > 5 (not a typosquat)? (5) Is it in the correct ecosystem (not cross-ecosystem conflation)? If ANY signal is suspicious, do NOT install. Treat every AI-generated import/require as untrusted input.
Why is registration date < 90 days a red flag for AI-recommended packages?
Registration date < 90 days is a red flag for AI-recommended packages because it aligns with the slopsquatting attack timeline. The attack chain: (1) AI hallucinates a package name when generating code. (2) Attacker discovers the hallucinated name by running the same AI model with similar prompts. Since AI hallucinations are consistent (the same model recommends the same hallucinated name across conversations), attackers can predict which names to register. (3) Attacker registers the hallucinated name on PyPI or npm with malicious code. This registration is recent -- it happened after the AI model started hallucinating the name. (4) The registration date is < 90 days because the attacker just registered it. If a package was registered recently AND matches an AI hallucination pattern (e.g., it's a name that AI models commonly hallucinate), it's likely a slopsquatting attack. Established packages (registered > 2 years) have a track record of legitimate use, community reviews, and download history. New packages matching AI hallucinations are suspicious because: (a) The attacker just registered the name after discovering the AI hallucination. (b) There's no community review or download history to validate the package. (c) The package may have been registered specifically to exploit AI recommendations. The 90-day threshold is a heuristic: most legitimate packages are registered well before they appear in AI recommendations. A package registered < 90 days ago that matches an AI hallucination pattern is statistically much more likely to be a slopsquatting attack than a legitimate package. Combine registration date with publisher identity (new account, first package) for a stronger signal."