Slopsquatting

What it means

Slopsquatting targets the gap between AI confidence and package reality. Attackers register plausible package names that models may invent, then wait for developers or agents to install them.

Why it matters for AI-written code

AI tools can suggest dependencies while writing code. If a hallucinated package name is later registered by an attacker, a quick install command can become a supply-chain compromise.

Guard and Fleet context

Guard treats slopsquatting as dependency risk amplified by agent-driven development. Fleet context helps reveal whether the same risky dependency pattern is spreading across projects.

How Enji Guard helps

Guard audits dependency changes, highlights suspicious package choices, and keeps the review focused on whether the package is real, needed, and safe for the project.