What we find, and what it means

Notes from the work: findings we keep seeing, fixes that hold up, and the reasoning behind how this product decides what counts as a risk.

1 article matching

Tagged npm · clear

Your AI just imported a package that doesn't exist

LLM assistants keep inventing plausible package names. Unclaimed, those names are an attacker's opportunity — slopsquatting is typosquatting's AI-era cousin, and most teams have no check for it.

Aug 27, 2026

AI Security

Talk to us.

Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.

01You writePlain form, no qualifying call, no obligation. The marketing checkbox is optional and unticked.

02A person reads itMessages land with the team, not a queue-bot. Nothing is auto-replied.

03You get an answerTo the address you gave — including “this product is not the right fit”, when that is the honest answer.

Prefer email?

privacy@webcuris.com

Reporting a vulnerability?

Read the disclosure policy first — it tells you what is in scope and what to expect.