Sergiy Fitsak and Softjourn’s near-miss
During routine development work, an engineer at Softjourn asked an AI agent to recommend a package for a common task. The agent returned the name of a package that looked legitimate and was formatted like a familiar library. Had the developer accepted the suggestion without verification, Softjourn says, they could have installed a malware package. The company’s policy — double-check any software recommendations made by AI — was followed, and that check turned what might have been a supply-chain compromise into a brief security anecdote.
How the engineer caught the fake package
Rather than installing immediately, the developer skimmed the recommended package’s source code on GitHub and examined its metadata. They noticed two red flags: the package had very few downloads and had been created only a few days earlier. Those anomalies prompted further scrutiny and prevented deployment of the package to the codebase. According to Fitsak, that human verification step is what revealed the suspicious nature of the recommendation.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadSlopsquatting: AI hallucinations weaponized
Fitsak said attackers have adapted to the tendency of AI models to invent plausible-sounding package names. “Attackers have caught on and now register real packages under those exact invented names, betting that a developer under deadline pressure will install first and check later,” he told us. Security researchers have started calling this pattern “slopsquatting.” The tactic leverages an AI model’s hallucinations as bait — the model invents a name, attackers register that name in a package registry, and an unvetted install brings malicious code into a project.
The unknown payload and what it could have done
Softjourn did not disclose an exact payload. The company noted only that, had the package been malicious, it “could have given crims a backdoor into their systems and the ability to steal data or wreak other havoc.” Fitsak emphasized the potential consequences of skipping verification: “It takes a few extra minutes. Skipping that step once is how a team ends up explaining a supply chain compromise instead of shipping a feature on time.”
What this means for technologists and security teams, procurement leaders, and attackers
- Technologists and security teams: The incident underscores a simple procedural defense: verify AI-recommended dependencies by checking download counts and source code repositories before installation. Softjourn’s habit of reviewing GitHub sources and registry metadata is what averted the compromise in this case.
- Enterprises and procurement leaders: Relying on AI for developer efficiency creates new supply-chain blind spots. Softjourn’s example suggests formalizing policies that require human review of externally sourced code recommended by AI tools, even for routine tasks, to prevent deadlines from driving risky shortcuts.
- Attackers and threat actors: The report documents a clear incentive structure for abuse: registering packages that mirror AI hallucinations is a low-cost way to increase the chance of code execution inside target environments, especially where developers skip verification under time pressure.
Conclusion: a small habit that prevented a big problem
The episode at Softjourn is a compact cautionary tale: an AI agent suggested a plausible-sounding package, an engineer paused to verify it, and a policy was credited with preventing a potential supply-chain compromise. Sergiy Fitsak’s admonition — “don’t trust: verify” — is the operative lesson. In an environment where attackers are registering names invented by models, the few minutes spent checking download counts and repository history may be the difference between shipping a feature and cleaning up a breach.
