Slopsquatting

Ask an AI to write code and it confidently imports packages that don't exist — it invents plausible names. Attackers watch for the popular hallucinations and register them first, with malware inside. Each row below is one AI-generated import riding from the model, through the registry (where its true nature is revealed), to install. Switch toVerified to gate every name against a trusted allowlist before anything runs.