What is slopsquatting?
Updated
Slopsquatting is registering a package name that an AI coding assistant has invented, so that anyone who installs the suggestion gets the attacker's code instead of an error.
Quotable facts
As of 2026-10-07
- Slopsquatting needs three things: an invented name, an attacker who registers it, and someone who installs it (definition, 2026-10-07).
- crowsnest install weighs how new a package is: under 30 days adds 0.4 risk (install check, 2026-10-07).
- crowsnest install stops at risk 0.6 or above; the limit is fixed (install check, 2026-10-07).
- A package Crowsnest has no data on adds 0.2 risk and still installs (install check, 2026-10-07).
Why does it matter?
The name looks reasonable because a program chose it. The package is new, so nobody has reported it. You trust the suggestion and install without looking.
How do I stay safe?
- Search for the package yourself before you install an assistant's suggestion.
- Check how old it is and how many people download it.
- Look for a link to a code repository that matches the name.
- Install through
crowsnest install.
What this does not do
This page defines the term. It does not list invented names, and Crowsnest cannot stop a package it has no data on. A plain npm install is not checked.
Where do I read more?
Related terms: typosquatting and supply chain attack. Read the full post, What is slopsquatting?, or see the FAQ. Back to the glossary.
Related
- TyposquattingTyposquatting is publishing a package whose name is almost the same as a popular one, such as a missing letter or a moved hyphen, hoping someone mistypes an install command.
- Supply chain attackA supply chain attack is when an attacker harms you by tampering with something you rely on, such as a software package, instead of attacking you directly.
- What is slopsquatting?An AI assistant can suggest a package that does not exist. An attacker can make it exist.
- FAQAnswers to common questions about Crowsnest: what it is, whether it needs API keys, what it costs, what it can't see and what to do when it says Hold.