AI Coding Assistants Hallucinate Package Names, Opening Door to 'Slopsquatting' Attacks

·1 views

AI coding assistants sometimes recommend non-existent package names with convincing, ecosystem-appropriate names — a phenomenon researchers call hallucination. Attackers are exploiting this by registering those commonly hallucinated names on PyPI and npm and publishing malicious packages under them, a technique dubbed 'slopsquatting'. In a recent incident reported by The Register, a human reviewer caught the threat by noticing a suggested package had almost no download history, preventing a potential compromise. Standard dependency-scanning tools like Snyk or Dependabot cannot detect these packages because newly registered, zero-download packages carry no known CVEs. No automated checkpoint currently exists between an AI's package suggestion and a developer running the install command, leaving manual review as the only reliable safeguard — one that is easily skipped under deadline pressure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer fixes null-body crash in Formbricks survey SDK flagged by Sentry

A production crash in the Formbricks open-source survey SDK was automatically detected and reported by Sentry as issue FORMBRICKS-CLOUD-3VE. The bug caused an uncaught TypeError in visitors' browsers when the SDK's makeRequest helper attempted to read properties off a null HTTP response body. The same flaw existed in two separate packages — @formbricks/js-core and @formbricks/surveys — leaving the error path entirely unguarded against null or non-JSON responses. Developer Lewis Awe patched both instances by wrapping response.json() calls to handle SyntaxErrors and adding null-safe checks before accessing response properties. Because Formbricks does not accept unsolicited community pull requests, the fix was opened and merged on a personal fork as part of DEV's Summer Bug Smash challenge powered by Sentry.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Video AI APIs silently return durations shorter than requested, developers warned

A software developer has highlighted a systemic issue with video generation APIs, where requesting a specific clip duration — such as 10 seconds — often results in a shorter rendered file with no warning or error returned. The root cause lies in how latent video diffusion models compress frames internally, meaning only certain frame counts are mathematically valid given each model's frame rate and block size. When a requested duration does not align with these legal frame counts, the model silently rounds down to the nearest valid length. This discrepancy becomes a practical problem when multiple clips are assembled into a timeline, causing cumulative sync errors with audio or music. The developer recommends that engineers building on such APIs enumerate valid durations at build time and treat duration as a constrained value rather than a free input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Swarm Runtime Lets Teams Scale from API Gateway to Multi-Agent AI Without Rewrites

A Rust-based AI runtime called Swarm is designed to eliminate the perceived trade-off between using a lightweight API gateway and a full agent orchestration framework. The tool allows engineering teams to start with a simple OpenAI-compatible proxy and progressively enable more advanced capabilities — such as multi-provider routing, stateful sessions, MCP tool execution, and multi-agent workflows — by changing configuration flags rather than rebuilding infrastructure. Developer teams typically scale their LLM stacks through predictable stages, and Swarm structures these as six configurable 'rungs,' each adding functionality without replacing the underlying runtime. The project is built in pure Rust and aims to avoid the common pattern of patching together separate microservices, vector stores, and evaluation scripts as requirements grow. By keeping the architecture unified, Swarm targets teams that want a production-grade binary at any stage of AI adoption without committing to a full agent framework from day one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Klick.tools Launches No-Signup QR Code and URL Shortener Platform with Open API

A developer has launched klick.tools, a free web utility platform offering a QR code generator and URL shortener that requires no account creation or email verification. The QR tool supports seven content types, custom styling, and WCAG contrast checking, with all rendering done client-side so no data leaves the user's device. The URL shortener allows link creation in seconds, tracks click statistics, and lets users update destination URLs without reprinting materials. A REST API backs both tools, enabling anonymous use with IP-based rate limiting or authenticated use via API key for higher quotas and full link management. The platform is hosted in Germany, collects no IP logs, sets no tracking cookies, and was designed with GDPR compliance as a core requirement from the outset.

0 comments Read more at DEV Community