Typosquatting
Also called: slopsquatting · package hallucination
Typosquatting is publishing a malicious package, model, skill or domain under a name that looks like a popular one, so people or AI agents install it by mistake. AI coding tools add a twist: they can suggest package names that do not exist, which attackers then register.
How it works
Attackers register near-miss names (a swapped letter, a missing hyphen, a different scope) or names that models tend to hallucinate, sometimes called slopsquatting. When a developer or agent installs the wrong name, the malicious code runs with their access.
How to defend
Verify package names and publishers before installing, use lockfiles and allow-lists for agents, and block installs of very new or unknown packages in automated environments.
Real cases 1 story
MED
Attack · AIR Security
Anthropic skill scanner bypassed: malicious skills marked safeAIR Security researchers say Anthropic's skill and plugin scanner for Claude organization skills marked malicious skills as safe, using look-alike domains, an unclaimed PyPI dependency and an obfuscated binary.