Skip to main content
SkillTotal
cd ~/labs
visitor@skilltotal:~$ cat ./labs/slopsquatting/mission.txt

Slopsquatting

lab 16 · ST-INSTALL-PY · LLM03
mission.txt
scenario

A coding assistant keeps recommending packages. Its five logged answers:

  1. To fetch pages, use requests and vectorstore-autoindex for the index.
  2. Build the API with fastapi; store embeddings with vectorstore-autoindex.
  3. Load data with numpy and validate with pydantic-schema-bridge.
  4. vectorstore-autoindex keeps the vector index in sync automatically.
  5. For model weights, add torch-lite-loader.

The registry already rejects exact collisions and near-popular names, so a real name or a typo is refused. But three of the suggested names do not exist on any registry at all — the model invented them.

objective

Read the assistant’s five answers, find the invented name it keeps repeating, and publish a pyproject.toml under that exact name so every developer who follows the assistant installs yours.

session — slopsquatting
pyproject.toml
Or start from:
▚ Intel

No leads yet. Declassify intel one step at a time when you’re stuck.

▰ Dossierclassified — solve to unseal

How this attack works

No typo was involved. A language model recommended a package that does not exist, and it did so in several answers because models reach for the same plausible-sounding name. Registering that invented name turns every repetition into an install. The registry’s collision and near-match guards never fire, because the name resembles nothing real.

Why it's dangerous

Studies of code-generating models find a meaningful share of suggested packages do not exist, and a subset of those names recur across prompts — which is exactly what makes squatting them profitable. An install then runs whatever the package ships. No scanner can know offline that a name was hallucinated; what SkillTotal checks is the package that actually arrives — its install hooks and capabilities, flagged as ST-INSTALL-PY and friends.

OWASP mapping

Maps to OWASP Top 10 for LLM Applications (2025): LLM03: Supply Chain and LLM09: Misinformation (a hallucinated dependency), with OWASP Agentic Skills AST02. SkillTotal cannot tell a name was invented, so it judges the installed package’s behaviour instead.

Related framework entries

These show which published techniques the level exercises. SkillTotal is not affiliated with OWASP or MITRE, and they do not endorse the labs.

How to defend

  • Before installing a suggested package, confirm it exists, who publishes it, and how old it is.
  • Treat a brand-new package with one maintainer and no history as untrusted until reviewed.
  • Install only from a reviewed lockfile with integrity hashes; never from an inferred name.
  • Use a private index / allowlist so an agent cannot pull an arbitrary public name.

SkillTotal catches this class of issue deterministically (rule ST-INSTALL-PY).

Scan AI component (free)

FAQ

How is this different from typosquatting?
Typosquatting needs you to mistype a real name. Slopsquatting needs no typo: the model invents a name that does not exist, repeats it, and the attacker registers it. The defender cannot rely on edit distance to a real package, because there is no real package to compare against.
How does SkillTotal help if it can't know the name was invented?
It analyses the package that gets installed — install-time hooks, dangerous capabilities, obfuscation — so a squatted package is caught by what it does, not by whether its name is spelled like a popular one.
Next lab: SSRF Through a Fetch Tool