SlopGuard
An IDE plugin that intercepts every install command your AI coding assistant suggests, verifies the package actually exists on npm, pip, Maven, Composer, or Go modules, and warns you — with a 'slop score' — before you run a hallucinated name.
software developers and security engineers using GitHub Copilot, Cursor, Claude Code, or similar AI coding assistants
- Real-time package-existence verification across npm, pip, Maven, Composer, and Go modules
- Inline 'slop score' badge on every AI-suggested import with one-click swap to a verified alternative
- Per-repo allow-list and block-list enforced at install time
- Slack or webhook alert to your security team when a flagged install slips through
Hallucinated package names are reproducible model behavior (43% reappear across runs), which means a defender can build a name-existence cache once and protect every developer using that model for months — the window to lead this category is open right now.
205,474 hallucinated names across 16 LLMs and a real attacker demonstration (15,000 downloads of a fake huggingface-cli) prove the threat is concreteWhat Is Slopsquatting? AI Packages & Supply Chain Attacks ↗
Existing SCA tools focus on vulnerabilities in real packages, not on whether an AI-suggested package exists at all — the gap is clearWhat Is Slopsquatting? AI Packages & Supply Chain Attacks ↗
Developers pay $10–$20/month for IDE plugins; security teams would also buy team seats at $20–$50/seat/monthWhat Is Slopsquatting? AI Packages & Supply Chain Attacks ↗
If model providers add package-existence grounding natively (likely within 1–2 years) the standalone plugin market could shrink
An IDE extension plus a fast registry-existence lookup API is buildable by 2–3 engineers in a few weeks