7 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
SlopGuard identifies non-existent package dependencies and supply chain attacks caused by AI coding assistants. It automates trust scoring and detects issues like typosquatting and namespace squatting across multiple programming ecosystems. The tool is designed to require no API keys and has a high detection accuracy.
If you do, here's more
SlopGuard is a tool designed to detect AI-generated hallucinated package dependencies, which can pose security risks in software development. AI coding assistants like ChatGPT and Copilot often generate non-existent package names in about 9-21% of their output. Attackers exploit this behavior by registering malicious packages that match these hallucinations. The term "slopsquatting" refers to this tactic, where developers unknowingly install harmful dependencies suggested by AI without proper verification.
The tool addresses several specific vulnerabilities. It can detect hallucinated packages, typosquatting attacks, and namespace squatting, among other threats. SlopGuard supports multiple programming ecosystems, including Ruby, Python, and Go, and requires no API keys to operate. Its automated trust scoring system minimizes manual maintenance and boasts a high performance rate: 71% verified in real-world tests, with 100% detection of hallucinations and an 18-fold speed increase in caching.
SlopGuard operates using a modular adapter architecture, making it easy to incorporate new ecosystems by implementing a single adapter class. The trust scoring process is divided into three stages, with the initial stage relying on basic metrics like download counts and package age. It can exit early if a package scores above certain thresholds, which helps streamline the detection process. For example, packages with over 10 million downloads receive a significant trust score boost, while others might be flagged for further analysis based on GitHub signals or dependencies. The tool's detailed anomaly detection strategies for each ecosystem highlight its adaptability and thoroughness in identifying security threats.
Questions about this article
No questions yet.