Post

LLMs hallucinating nonexistent software packages with plausible names leads to a new malware vulnerability: "slopsquatting."

theregister.comLLMs can't stop making up software dependencies and sabotaging everything: Hallucinated package names fuel 'slopsquatting'

Elephasmaxi

@elephasmaxi.xyz

13 Apr 2025

For some, using a locally installed LLM not connected to internet can be a solution. Maybe it will not be 100% up to date but does it really need to be? My biggest worry is malware infected libraries.

David D. Levine

@daviddlevine.com

Not a solution. A locally installed LLM is exactly as likely to hallucinate nonexistent package names as an internet-connected one. It's the internet connection of the *compiler* that allows the malware to enter. And all modern development environments require an internet connection to run.

13/4/25, 3:45 pm0 reposts11 likes

Elephasmaxi

@elephasmaxi.xyz

13 Apr 2025

I guess I'm relying on the assumption that, as time passes, more and more seeding of LLM releases will occur. But you are right, once it's there it's a danger.