sup-01-slopsquat: Slopsquatting canary package demo
Category: AI supply chain (feintkit-supplychain). Loopback port: none (standard input and output only).
What it simulates
An assistant suggests a plausible package name that does not exist, so an attacker who registers that name receives the install.
Code-generating language models sometimes recommend packages that do not exist. A measurement study of 16 models found hallucinated package names in at least 5.2 percent of samples from commercial models and 21.7 percent from open-source models, and many of the invented names recur. An attacker can register such a name on a public registry and wait for a developer or an agent to install it; the practice is called slopsquatting. This scenario writes metadata for one canary package name, from a reserved feintkit-canary- pattern, as a package.json style file and a requirements style list. The files contain no install script and no code, and the scenario never publishes, installs, or resolves anything. A security product should flag any attempt to resolve the canary name, in a package-manager command, a registry request, or an assistant's output.
Mapping
- MITRE ATLAS: AML.T0060, AML.T0011.001, AML.T0010.001
- OWASP LLM Top 10 2025: LLM03:2025, LLM09:2025
- OWASP Agentic Top 10 2026: ASI04
Why these techniques apply
- AML.T0060: Package named after a name an LLM commonly hallucinates.
- AML.T0011.001: Victim installs a malicious package.
- AML.T0010.001: AI software supply chain.
What a product should detect
| Signal | What to flag | Where | Match rule |
|---|---|---|---|
| S1 | A package-manager command, registry or mirror request, or assistant output that resolves or recommends the canary package name | process command lines, registry or proxy request paths, agent reply or transcript | feintkit-canary-[a-z0-9-]+ |
| S2 | Canary manifests in a project, repository, or output directory | canary/package.canary.json and canary/requirements.canary.txt in the output directory, or wherever a tester copied them | "name": "feintkit-canary-json-schema-fastcheck"|^feintkit-canary-json-schema-fastcheck==0\.0\.0$ |
| S3 | Feintkit marker string in the canary files, the marker file, and the events | output directory (canary/package.canary.json, canary/requirements.canary.txt, proof.txt, events.jsonl) | FEINTKIT::sup-01-slopsquat::[A-Za-z0-9]{4,16}::DEFENSIVE-TEST-ONLY |
What a defender can do
- Restrict: Check that a package exists, and is the one you meant, before installing it, and restrict installs to an approved registry or mirror.
- Add a rule: Alert on an install or registry request for a package name that is not on the approved list.
- Change a setting: Use a private registry or mirror with an allow list, lock dependencies with hashes, and require review for new dependencies.
Run it
feintkit run sup-01-slopsquat --root <repository> --deterministic, then feintkit verify sup-01-slopsquat --root <repository>.
Every artifact contains FEINTKIT::sup-01-slopsquat::<run id>::DEFENSIVE-TEST-ONLY. Read RESPONSIBLE-USE.md before running.