Post

LLMs hallucinating nonexistent software packages with plausible names leads to a new malware vulnerability: "slopsquatting."

People have been package-name squatting for ages. Different spellings of popular packages are a particularly ripe target.

hell, look at the leftpad incident

I always get worried in particular about packages whose common names are different from what you actually type to install them (for example, to install PyTorch, it's not "pip install PyTorch" or "pip install pytorch", but rather "pip install torch).. It's a really common situation...