Loading story…
ENISA published a March 2026 technical advisory on the secure use of package managers, warning that modern development workflows (e.g., npm, pip, Maven) can pull in far more code than developers expect due to direct and transitive dependency resolution. The advisory highlights how applications inherit large dependency graphs—often including unused modules—that still introduce vulnerabilities, maintenance and provenance risk, and expanded trust assumptions across the software supply chain. ENISA recommends secure practices for selecting, integrating, monitoring, and remediating vulnerable third-party dependencies as part of the SDLC.
Separately, security researchers and industry commentary describe slopsquatting, a supply-chain technique that exploits AI coding assistants’ tendency to hallucinate plausible-but-nonexistent package names. Attackers can register those “phantom” names in public repositories and publish packages that appear to match the expected functionality while embedding malicious payloads, turning AI-generated suggestions into a predictable package-name acquisition strategy. The risk is positioned as distinct from typosquatting (human error) and is framed as requiring additional detection approaches beyond traditional controls, including more behavioral and validation-focused checks before adopting AI-suggested dependencies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ENISA's March 2026 Technical Advisory on secure package manager use warned about software supply-chain risks from public repositories, transitive dependencies, malicious packages, and compromised maintainer accounts. The advisory also noted that AI/LLM-assisted development can introduce dependencies that require the same validation and security review as manually chosen packages.
Contrast Security published an analysis of 'slopsquatting,' a software supply-chain technique in which attackers register AI-hallucinated package names and seed them with malicious code. The write-up explains how AI coding assistants can suggest non-existent dependencies that developers may install without verification.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Software supply-chain compromise continued to blend into normal development activity, with attackers exploiting the speed and trust of modern workflows—third-party dependencies, automated updates, and rapid release cycles—to distribute malware and steal credentials. A ReversingLabs study covering 2025 open-source ecosystems reported **npm** as the dominant distribution channel for malicious packages, including incidents where attackers **compromised maintainer accounts** and shipped tainted updates that propagated quickly into downstream projects via routine dependency updates and CI/CD processes. One highlighted case was the **Shai-hulud** worm, described as a registry-native, self-propagating threat that used **stolen credentials** to inject malicious code into **hundreds of packages**, exposing **tens of thousands of downstream repositories** and complicating detection because it did not rely on external infrastructure. In parallel, commentary on generative AI’s impact on software delivery emphasized that faster code production and release pressure can increase security debt: reported industry claims that **20–30% of code** at major firms is AI-generated, alongside estimates that a large share of AI-generated code can introduce **OWASP Top 10**-class weaknesses, reinforcing the need for stronger testing and controls as development velocity increases.
Jun 29, 2026
Attackers are exploiting AI-generated dependency hallucinations by registering malicious packages under names that coding assistants and autonomous agents invent, a technique known as **slopsquatting** or **hallusquatting**. The threat has progressed from a 2023 proof of concept around the nonexistent package `huggingface-cli` to broader evidence that AI tools repeatedly recommend packages that do not exist; a 2025 academic measurement found **19.7%** of AI-suggested Python and JavaScript packages were nonexistent, with many hallucinated names recurring across prompts and models. The risk escalated in 2026 as hallucinated package names began propagating through agentic development workflows and automated installs. Researchers reported the fake npm package name `react-codeshift` spreading across **237 repositories**, while the malicious package `unused-imports` continued to be installed, showing how model output can become a software supply-chain infection path. A July 2026 **HalluSquatting** variant further combined hallucinated resources with prompt injection to drive AI coding agents toward **remote code execution (RCE)**, expanding the attack surface from human typo-based dependency mistakes to model-generated and agent-executed compromise.
Jul 22, 2026
OWASP has published a beta **Top 10 for Model Context Protocol (MCP)**, warning that MCP-enabled AI systems introduce new attack surfaces across token handling, privilege management, tool integrity, supply chain security, command execution, authentication, telemetry, shadow deployments, and context sharing. The project frames MCP as a fast-growing integration layer for AI tools and agents, and highlights the need for stronger controls as organizations connect models to external tools, data sources, and developer workflows. Security researchers and vendors are also warning that AI is expanding software supply chain risk through **package hallucinations** and **slopsquatting**, in which attackers register malicious packages under names invented by coding assistants. One cited proof of concept involved the hallucinated package `huggingface-cli`, which was later downloaded more than 30,000 times after publication as a benign placeholder. Researchers say autonomous coding agents can amplify the danger by installing dependencies with little or no human review, while related risks include malicious package campaigns, secret leakage in AI-generated code, and broader compromise of developer environments and software delivery pipelines.
Jul 16, 2026