AI agent suggested installing a malware package. Engineer almost took its advice

The Register reports that an engineer at Softjourn asked an AI assistant for a package recommendation, and the model suggested a newly created library with a plausible name. The developer, following company policy, examined the GitHub repository, noticed the package had barely any downloads and had been published only days earlier, and decided not to install it. The incident highlights a growing tactic dubbed slopsquatting, where attackers register AI‑hallucinated package names to trick developers into installing malware. The episode underscores the importance of verifying any AI‑suggested code before adding it to a project.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton