2026-07-22 · 5 min read

Slopsquatting: the supply chain attack your code review should catch

Earlier this year security researcher Charlie Eriksen found an npm package named react-codeshift referenced across 237 repositories. The package had never existed. An AI assistant invented the name, other AIs kept repeating it, and forks spread it like seed. The researcher registered the name himself before someone less friendly could. That race, between whoever notices the hallucination and whoever weaponizes it, now has a name: slopsquatting.

What's been happening

The mechanics are almost embarrassingly simple. Language models autocomplete package names from patterns, not from the registry. Ask for a React codemod helper and you may get an import that blends jscodeshift and react-codemod into something that feels more right than either. The name is fabricated, but it's fabricated consistently: research on the topic keeps finding that models repeat the same invented names across sessions and users. A repeatable hallucination is a predictable install, and a predictable install is an attack surface. Whoever publishes that name first owns every machine that resolves it.

This stopped being theoretical a while ago. Besides react-codeshift, there's the documented case of unused-imports, a malicious npm package sitting on a name models habitually produce instead of the legitimate eslint-plugin-unused-imports, and it was still collecting hundreds of downloads a week after being flagged (CSA has a good research note on the pattern). This month the topic escalated again: researchers described chaining a hallucinated resource with prompt injection so that an AI coding agent fetching it can be hijacked outright, and the attack surface got mainstream business-press attention. The window between "the model made it up" and "someone owns it" is closing fast.

Where the defenses actually sit

Registry scanning helps, and lockfile discipline helps, and tooling that cross-checks dependencies against known-good lists helps too, but look at where the bad line actually enters your codebase: through a pull request. Somebody, increasingly an AI agent acting on its own, opens a diff that adds a dependency and an import, and then somebody else approves it. Between the hallucination and your CI secrets there is exactly one human checkpoint, and it's the reviewer who clicks the green button.

Companies have started acting like they understand this, and the interesting thing is how low-tech the responses are. After its string of AI-assisted incidents this spring, Amazon's response wasn't a smarter scanner or a tighter lockfile policy; it was mandatory review by two people for changes to critical systems. Just more human eyes on the diff. Meanwhile Salt Security's June survey found that 38% of organizations still rely primarily on manual review to catch problems in AI-generated code, and whether that number scares you or reassures you probably depends on how much you trust the people doing the reviewing, but either way it means the same thing: the reviewer's eye is load-bearing infrastructure now, whether anyone planned for that or not.

Would you have caught it?

Here's roughly what the react-codeshift case looks like as a PR. An agent was asked to add a class-to-hooks migration script. Read it like you'd review it at work:

The uncomfortable part is that in a real review queue this line doesn't glow or flash or do anything to draw your attention. It sits in the quiet part of the diff, the dependency block that most reviewers scroll past without reading, sandwiched between two packages that are completely legitimate. Every bug an AI writes wears that same calm face, but this one is worse than most, because the consequence isn't a logic error or a missing edge case; it's running attacker-controlled code on your build server. The instinct that catches it, pausing on every load-bearing name you don't personally recognize, is not a tool you can install or a linter rule you can configure. It's a reflex, and reflexes come from reps.

Building the reflex

You can build that reflex the same way you'd build any other reviewing muscle: deliberate reps with honest feedback about what you caught and what you missed. Hallucinated APIs and dependencies are one of the core failure categories on DiffDojo, precisely because they're the failure mode where reading well is the whole game, where no linter or type checker or CI pipeline will save you and the only thing between the bad line and production is whether your eyes stopped in the right place. You review a realistic AI-written PR, call out what's broken, give a verdict, and get graded against a canonical review that shows you exactly what was planted and what you walked past, including the days when everything is actually fine and the discipline is to approve without inventing problems. Today's PR is free, no signup.

Whatever you use to practice, the takeaway from the last few months of slopsquatting news is worth taping to the monitor: if a dependency is new and you don't personally know it exists, check before you approve. Open the registry page, look at the publisher, look at the download history, look for a repo link that actually goes somewhere. Thirty seconds of verification against a supply chain incident is the best trade in this industry, and it's one that no amount of tooling has managed to automate away.