Slopsquatting risks, Morocco leak, EC ups US-based staff security

Emergence of Slop Squatting in Software Supply Chain Attacks

Slop squatting represents a new threat in software supply chains, where malicious actors create fake software packages that mimic commonly generated names by large language models (LLMs). This tactic relies on the inherent flaws in AI-generated code, such as hallucinations, which can occur at different rates depending on the LLM used; open-source models may hallucinate packages over 35% of the time, while commercial models often fall below 5%. A recent study revealed that over half of the hallucinated packages were repeated across multiple runs of the same prompt, highlighting the persistent risk presented by this attack vector. Additionally, advanced models like GPT-4 Turbo have shown the ability to accurately identify these hallucinated packages, achieving a correction rate of more than 75%.