Slopsquatting and the Invisible Package Firewall: When AI Agents Run npm install

When developers write code by hand, dependency intake has built-in cognitive friction:

1. You search npm, PyPI, or Crates.io for a library.
2. You look at GitHub stars, weekly download graphs, the latest commit date, and the maintainer profile.
3. You review the diff in package.json before opening a pull request.

In vibe coding, that entire cognitive firewall evaporates in a split second.

You prompt an AI coding agent: “Add Azure OpenAI auth token caching with streaming support.” The agent writes fifteen files, constructs an elegant architectural facade, and runs a terminal command:

npm install langchain-azure-openai-helper
# or
pip install react-native-tailwind-styled

The terminal prints green text. The UI renders without layout shifts. The tests pass. You hit git commit -am "feat: add azure auth" and push to main.

You never checked if langchain-azure-openai-helper was a real open-source library or an attacker-registered landmine.

---

The Anatomy of Slopsquatting: 200,000 Predictable Phantoms

The root of this vulnerability lies in how Large Language Models generate code. LLMs do not query a live registry API; they predict the next most statistically probable sequence of tokens based on semantic context.

When faced with a domain-specific integration challenge, models synthesize plausible-sounding package names by combining standard framework prefixes and functional keywords (flask-, @langchain/, react-native-, -helper, -utils).

[ Developer Prompt ] ──► [ LLM Next-Token Prediction ]
                              │
                              ▼
            Synthesizes Non-Existent Package Name:
            "huggingface-cli" / "langchain-tools-aws"
                              │
                              ▼
               [ Measured Hallucination Rates ]
               • Frontier Commercial (GPT-4o, Claude, Gemini): ~4.6% - 6.1%
               • Open-Weight Models (Llama 3, DeepSeek):      ~19.7% - 22.4%
                              │
                              ▼
        [ Adversary Pre-Registers Name on PyPI / npm ]
                              │
                              ▼
        [ Developer / Agent Runs `npm i` or `pip install` ]
                              │
                              ▼
      [ Arbitrary Code Execution on Developer Workstation ]

Pioneering empirical studies (originating with Bar Lanyado and Vulcan Cyber’s research, and expanded across 576,000 code samples in academic benchmarks) revealed a startling finding: LLM package hallucinations are highly deterministic and repeatable.

When 10,000 developers ask an LLM similar questions about Hugging Face tokenizers or Azure SDK wrappers, the model hallucinates the exact same non-existent package names.

Threat actors noticed this predictability:

1. Automated Prompt Mining: Attackers feed millions of programmatic prompts into top LLMs, cataloging every suggested package that returns a 404 Not Found on PyPI or npm.
2. Pre-Registration Squatting (“Slopsquatting”): Attackers publish minimal placeholder packages with valid semver metadata under those hallucinated names.
3. Passive Landmine Harvesting: The attacker waits. Days or weeks later, an autonomous agent in a vibe coding loop prompts the same pattern, installs the package, and immediately executes the attacker’s payload.

[!WARNING] The huggingface-cli Precedent: LLMs frequently advised developers to run pip install huggingface-cli (hallucinating the package name because the CLI binary was named huggingface-cli, whereas the legitimate library was huggingface_hub). Attackers claimed the namespace on PyPI, capturing thousands of developer installations before registry moderators revoked it.

---

The Workstation Execution Vector: Why --ignore-scripts Isn’t Enough

The threat is not merely that a non-existent package fails to solve the user’s coding problem. The threat is that package managers execute arbitrary code before any application source code runs.

[ Agent runs: npm install <pkg> ]
               │
               ▼
   [ Lifecycle Hooks Trigger ]
   • package.json -> postinstall / preinstall
   • binding.gyp  -> node-gyp native compile
   • Python wheel -> setup.py / .pth auto-exec
               │
               ▼
[ Silent Workstation Harvest (<500ms) ]
   • ~/.aws/credentials
   • ~/.ssh/id_rsa & known_hosts
   • .env / .env.local secrets
   • Browser cookies & session tokens
   • ~/.npmrc & ~/.pypirc publishing tokens
               │
               ▼
[ Self-Propagating Ecosystem Worm ]
   (Shai-Hulud / Hades / Miasma campaigns)

In modern AI coding workflows (Cursor, Claude Code, Devin, Windsurf, Antigravity), agents often operate with direct terminal execution permissions. When an agent runs npm install, lifecycle scripts trigger immediately:

• npm: preinstall, install, postinstall, and binding.gyp triggers.
• Python / pip: setup.py execution during wheel builds and .pth hook execution upon interpreter boot.
• Rust / Cargo: build.rs execution during crate compilation.

In under 500 milliseconds, an infostealer scrapes ~/.ssh, ~/.aws, .env, and browser session cookies. Even worse, campaigns like Shai-Hulud and Hades harvest ~/.npmrc and ~/.pypirc publishing tokens, automatically trojanizing and republishing all other open-source packages maintained by that developer.

---

Why Traditional SCA and CVE Scanners Fail

Traditional security tooling was designed for human software engineering lifecycles:

Security Tool	Why It Collapses in Vibe Coding
CVE Scanners (Dependabot, Snyk)	Malicious packages are malicious from version 0.0.1. They have zero published CVEs and zero NVD entries.
Static Code Analysis (SAST)	SAST scans repository source files. It never inspects dynamic build hooks or obfuscated bytecode executed inside node_modules at install time.
npm --ignore-scripts	Bypassed by native binding.gyp compilation steps, Python .pth startup hooks, and IDE-level repository tasks (.vscode/tasks.json with runOn: folderOpen).
Nightly CI Scanners	2026 malware campaigns use “fast-flux” lifecycles: publishing a malicious version, harvesting target credentials, and unpublishing within 15 minutes to evade scheduled scans.

---

The Defense-in-Depth Architecture

To allow autonomous agents and vibe coders to operate at maximum velocity without turning developer workstations into credential exfiltration endpoints, we implemented a 4-layer defense boundary:

[ AI Agent Proposes Dependency ]
               │
               ▼
[ Layer 1: AGENTS.md Ingestion Gate ]
   • Ponytail Rung 3: Stdlib check (Python/Node stdlib first)
   • Strict prohibition on unreviewed package additions
               │
               ▼
[ Layer 2: Socket Firewall (sfw / socket-cli) ]
   • Deep AST semantic inspection (70+ behavioral red flags)
   • Environment variable harvesting detection (process.env, os.environ)
   • Slopsquat & typosquat Levenshtein scoring
   • Real-time install interception before disk write
               │
               ▼
[ Layer 3: Ephemeral Isolated Sandboxing ]
   • Ephemeral containers / microVM runtimes (rootless Docker/Podman)
   • Secret isolation: ~/.ssh, ~/.aws, .env unmounted
   • Egress network filtering: Registry endpoints only
               │
               ▼
[ Layer 4: Hardened Flags & Deterministic Lockfiles ]
   • bun add --ignore-scripts / npm ci
   • pip install --only-binary :all: --require-hashes

1. Codifying Supply Chain Defense in AGENTS.md

We formalized dependency intake rules directly into our global agent system prompt:

## Supply Chain & Dependency Intake Guardrails

- **Stdlib Over Packages**: Never introduce a 3rd-party package if Node/Python/Rust stdlib or existing utilities suffice.
- **Safe Install Default**: Always invoke package managers with safety flags (`npm install --ignore-scripts`, `pip install --only-binary :all:`, `bun add --ignore-scripts`) or via Socket wrapper (`socket npm`).
- **No Blind Installs**: Propose new root dependencies as part of the Plan/Approve step before executing terminal install commands.
- **Lockfile Discipline**: Always commit and respect deterministic lockfiles (`package-lock.json`, `uv.lock`, `Cargo.lock`, `bun.lock`).
- **Secret Isolation Boundary**: Never inspect, expose, or pass workstation secrets (`~/.ssh`, `~/.aws`, `~/.npmrc`, `~/.pypirc`, `.env`) in agent tool arguments or output.

2. Real-Time Interception with Socket Firewall (socket-cli)

Instead of relying on post-facto manifest scanning, we route terminal invocations through Socket’s AST analysis engine:

# Enable transparent interception in shell environments
socket wrapper on
source ~/.bashrc

When an agent attempts to install an unverified or slopsquatted package, Socket’s AST parser disassembles the package in memory, inspects outbound network calls, flags process.env harvesting, and halts installation before any lifecycle script executes on the host.

---

The Lesson for the Agentic Era

Vibe coding is the most exhilarating paradigm shift in software engineering since the invention of the compiler. It compresses days of boilerplate into seconds of natural language synthesis.

Speed without boundary validation is not engineering; it is an unforced credential leak.

The best code is still the code never written. And the safest dependency is the one your AI agent realized you never needed in the first place.