An AI Coding Agent Told an Engineer to Install Malware. A GitHub Habit Stopped It.
An engineer asked an AI coding agent for a package and it named one that was malware. Only a company rule to review any AI-recommended code on GitHub first caught the slop-squatting attempt before install.
An engineer asked an AI coding agent to recommend a software package for a routine task, and the agent handed back the name of a malicious one. The developer very nearly installed it. What stopped a supply chain compromise was not a scanner or a firewall. It was a mundane company rule: review the source code on GitHub before installing anything an AI suggests.
The near-miss was reported on August 20, 2026 by The Register in its PWNED column, drawn from an account by Sergiy Fitsak, managing director of the software consultancy Softjourn. It is a small anecdote carrying a large lesson, and it is worth pulling apart, because the failure mode it describes, slop-squatting, is aimed squarely at the way developers now write code.
What Actually Happened
During the course of normal work, one Softjourn engineer asked an AI agent to recommend a package they needed for a common task. The agent returned a legitimate-sounding name, formatted like a familiar library. At a lot of shops, that is where the story ends. The developer takes the recommendation, installs it, and moves on to the next ticket.
Softjourn had a policy, and the developer actually followed it: double-check any software an AI recommends before trusting it. Skimming the package's source on GitHub, the engineer noticed two things. It had very few downloads, and it had been created only a few days earlier. Both are classic markers of a freshly planted malicious package rather than an established dependency. The install was stopped before anything reached the codebase.
"The problem is that AI models sometimes invent package names that sound plausible but don't exist, a pattern security researchers have started calling 'slopsquatting,'" Fitsak told The Register. "Attackers have caught on and now register real packages under those exact invented names, betting that a developer under deadline pressure will install first and check later."
What Slop-Squatting Is, and Why It Works
Slop-squatting is a software supply chain attack that weaponizes AI hallucinations. Large language models routinely invent package names that sound real but do not exist. Attackers watch for the names that models tend to hallucinate, register those exact names in a public package registry, and load them with malicious code. The developer, or an agent acting on their behalf, then installs a real package. Just not the one anyone intended.
It is a close cousin of typosquatting, with one important difference. Typosquatting preys on human error, betting that someone fat-fingers a well-known package name. Slop-squatting preys on machine confidence, betting that an AI assistant will confidently name a package that a criminal has already staked out. The hallucinated name is not a misspelling of a real library. It is a plausible-sounding invention, and the attacker got there first.
The mechanic fits a broader pattern The CyberSignal has tracked: AI systems producing confident, professional-looking artifacts that are quietly wrong. When Google disclosed the first AI-generated zero-day caught in the wild, the tell was a hallucinated CVSS score baked into the exploit code. The open-source ecosystem is now large enough that automated systems, including Unit 42's disclosure of more than 14,000 AI-discovered flaws across open-source packages, are probing it at machine speed. Slop-squatting is the flip side: attackers using the model's own guesses as a targeting list.
The risk sharpens as agents get more autonomous. A developer who copies a package name out of a chat window still has a moment to pause. An agent wired to run install commands on its own does not, and it will act on a name it invented with the same confidence it brings to a correct answer. That is what Softjourn's rule actually guards against. The weak point is not the hallucination, which is effectively inevitable, but the missing human check between the suggestion and the install.
● Slop-Squatting Near-Miss How one AI package recommendation almost became a supply chain compromise |
1. AI Agent Recommends A developer asks an AI coding agent for a package. It returns a legitimate-sounding name, formatted like a familiar library. |
| ↓ |
2. Policy Checkpoint Company rule: verify any AI software recommendation before installing. No package goes in on the agent's word alone. |
| ↓ |
3. The Tell A quick GitHub source review shows the package has few downloads and was created only days earlier. It is flagged as suspicious. |
| ↓ |
4. Outcome Install blocked. No backdoor, no data theft. Without the review habit, the malware ships straight into the build. |
Source: The Register (PWNED), August 20, 2026, on a near-miss at Softjourn. Diagram: The CyberSignal. |
The decision path of a slop-squatting near-miss: an AI coding agent recommends a package, a mandatory source review flags it as suspicious (few downloads, created days earlier), and the install is blocked before any malicious code reaches the build.
Why the Boring Habit Won
The control that worked here costs nothing and requires no new tooling. The engineer opened the package's GitHub repository and looked at two numbers: how many times it had been downloaded, and when it was created. A legitimate library that an AI would recommend for a common task tends to have a long history and meaningful adoption. A package with almost no downloads that appeared days ago, sitting under a name a model just suggested, is the profile of a trap.
Fitsak's framing is the part defenders should copy verbatim. "We caught it because we'd already built a habit of verifying download counts and reviewing source code on GitHub before installing anything an AI recommends, even when it looks routine," he told The Register. "It takes a few extra minutes. Skipping that step once is how a team ends up explaining a supply chain compromise instead of shipping a feature on time."
That habit also maps onto registry-side defenses that have started to ship. Package ecosystems are adding friction precisely around new and low-reputation packages, from upload rules to cooldown windows that hold back brand-new dependency versions until they have aged. A freshly registered package is exactly what slop-squatting relies on, so a policy that treats new-and-unknown as a stop signal is doing real work.
What Defenders Should Do
The lesson for any team running AI coding tools is that the model's suggestion is an input, not an instruction. Turn one lucky catch into a repeatable control:
- Mandate a source review before install. Require a human to open the package's repository and check its age, download or star history, maintainers, and recent commits before it enters the project. Write it into the definition of done, the way Softjourn did.
- Deny direct install from AI recommendations. Keep a human approval gate between an agent's suggestion and any dependency actually landing in the build. Agents that can run install commands autonomously should not be allowed to add new third-party packages without sign-off.
- Pin and allowlist dependencies. Lock versions, use a curated internal registry or allowlist of approved packages, and make adding a brand-new dependency a deliberate, reviewed action rather than a default one.
- Monitor registry signals. Flag packages that are newly created, thinly downloaded, or first appear via an AI suggestion. Where your ecosystem offers cooldown or quarantine windows for new versions, turn them on.
What We Do Not Know Yet
The Register did not name the AI tool that made the recommendation, the malicious package, or the registry it was staged in, and it did not say whether the package has since been removed. The individual engineer is not identified. Treat those specifics as unconfirmed. What is confirmed is the shape of the attack, the company (Softjourn), the source (managing director Sergiy Fitsak), and the control that caught it. This was a near-miss, not a breach: there is no reported compromise.
My read: The most useful detail in this story is how ordinary the save was. No AI-powered supply chain scanner caught this. A person spent two minutes reading a GitHub page. As more teams let agents propose and even install dependencies, the attack surface is not some exotic new exploit, it is the removal of that two-minute pause. The defensible posture is to make the pause mandatory and boring, so a rushed engineer cannot skip it, rather than betting that a tool will catch slop-squatting after the fact. Assessment, not reported fact: I expect slop-squatting to scale faster than typosquatting did, because the attacker no longer has to guess which mistakes humans make. The model volunteers them.
Primary documents
