CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

AI-Enabled Coding Assistants Exploited via Slopsquatting

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Threat actors are exploiting AI-enabled coding assistants by targeting hallucinated software libraries. These assistants, which 97% of developers use, recommend non-existent packages. Attackers register malicious versions of these hallucinated libraries, leading to 'slopsquatting' attacks. For example, a malicious package 'ccxt-mexc-futures' was downloaded over 1,000 times on PyPI, modifying cryptocurrency trading operations. This highlights the growing third-party risks in software supply chains, emphasizing the need for proactive security measures. The evolution of third-party risks, from open-source vulnerabilities like Log4Shell to AI-assisted coding threats, underscores the importance of visibility and proactive security practices in software development.

Timeline

  1. 16.12.2025 20:00 1 articles · 4h ago

    Slopsquatting Attacks Exploit AI-Enabled Coding Assistants

    Threat actors are now targeting AI-enabled coding assistants by exploiting their tendency to hallucinate non-existent software libraries. These hallucinated libraries are then registered with malicious code, leading to 'slopsquatting' attacks. For instance, a malicious package 'ccxt-mexc-futures' was downloaded over 1,000 times on PyPI, modifying cryptocurrency trading operations. This highlights the growing risks associated with AI-assisted coding and the need for enhanced security measures in software development.

    Show sources
    Open in new tab

Information Snippets