Executive Summary
Nearly 800 malicious npm packages with AI-style slopsquatted or random typosquat names deliver a cross-platform RAT and infostealer.
What Happened
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul
Affected Products
- npm
Vulnerability / Attack Technique
Slopsquatting and typosquatting
Technical Mechanism
Package names mimic those AI tools may hallucinate.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Attackers register names that AI assistants might invent. RealGround analysis: verify every AI-suggested package exists and is reputable.
Recommended Controls
- Verify AI-suggested package names before installing
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.