What we find, and what it means

Notes from the work: findings we keep seeing, fixes that hold up, and the reasoning behind how this product decides what counts as a risk.

2 articles matching

Tagged slopsquatting · clear

Your AI just imported a package that doesn't exist

LLM assistants keep inventing plausible package names. Unclaimed, those names are an attacker's opportunity — slopsquatting is typosquatting's AI-era cousin, and most teams have no check for it.

Aug 27, 2026

AI Security

What Is Slopsquatting? How AI-Invented Packages End Up in Real Codebases

Attackers register the package names AI assistants invent. What the research measured, how to find a hallucinated dependency already sitting in your repo, and why a one-time cleanup is not a control.

Aug 24, 20264 min read

AI Security

Talk to us.

Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.

01You writePlain form, no qualifying call, no obligation. The marketing checkbox is optional and unticked.

02A person reads itMessages land with the team, not a queue-bot. Nothing is auto-replied.

03You get an answerTo the address you gave — including “this product is not the right fit”, when that is the honest answer.

Prefer email?

privacy@webcuris.com

Reporting a vulnerability?

Read the disclosure policy first — it tells you what is in scope and what to expect.