AI supply chain attack vs Slopsquatting

Why they differ

Both abuse trust in downloads, but slopsquatting plants code packages under names an AI invents, while an AI supply chain attack tampers with the AI's own parts.

AI supply chain attack

AI risk & governance

Attacking the ready-made parts an AI system is built from - shared models, datasets or plug-in files - instead of the system itself.

Formal

Tampering with third-party parts of an AI system - model weights, add-on files such as LoRA, training data, model files that run hidden code when loaded, or copycat model pages on public hubs; OWASP lists it as LLM03:2025.

In plain English

Like buying a spare part from a shop whose name differs by one letter from your usual one - it fits and works, but someone altered it before it reached you.

In practice

A developer in a pension fund's IT department downloads a popular open model from a copycat page; loading its old-style file quietly runs code that opens a back door on the build server.

Why it matters

Most teams build on models and data they did not make and cannot fully inspect, so one poisoned download can reach every product that uses it.

Slopsquatting

AI-assisted coding

An attack where criminals publish harmful packages under the made-up names that AI tools keep inventing for code.

Formal

A supply-chain attack in which an attacker collects package names that large language models make up through hallucination while writing code, registers those unclaimed names in a public package registry, and fills them with harmful code that runs when a developer or coding agent installs the suggested package.

In plain English

Like a shop assistant who keeps recommending a brand that does not exist - until a crook notices, starts selling fakes under that exact name, and waits for customers to ask for it.

In practice

A developer at a Danish logistics firm is told by an assistant to install a helper library with a believable but invented name; an attacker registered that name last month, and installing it quietly copies her cloud access keys.

Why it matters

Research found that many invented names come back each time the same question is asked again, so attackers can predict and register them in advance - and one careless install hands them the build machine.

Shared connections

Software supply chain Supply chain attack