AI-Powered Slopsquatting: Is Your Software Supply Chain Compromised?
summary
Claims that AI-generated slopsquatting scales malicious dependency injection by exploiting naming variants and developer habits, showing ~1M malicious packages per year and concrete compromises like Axios 1.141 poisoned and npm/SAP packages that install remote access trojans and steal CI/CD secrets. Demonstrations include a self‑replicating mini-sai worm: 160 packages/24h that harvests tokens. Defenses used and evaluated are package cooldowns (24–120h), Nexus/JFrog/Sonatype package firewalls, CI/CD network restrictions, mandatory token rotation and quarantined registries, with mixed operational success depending on tooling coverage.
AI-written summary · about
chapters (9)
- 0:00AI-driven supply chain risks
- 3:15AI accelerates supply chain attacks
- 10:39Supply chain compromise examples
- 15:59AI-powered worms like Mini Sihood
- 20:13Defending with cooldowns
- 23:51Zero trust and CI/CD security
- 27:45DevOps toolchain security gaps
- 31:36Security funding lacks support
- 34:08Future of secure supply chains
related talks
01h 02mProtect Yourself Against Supply Chain Attacks
28mOwn Goal: How AI Agents Are Quietly Scoring for the Other Side
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
01h 02mInside Today’s AI-Accelerated Software Supply Chain Attacks
44mSlaying the Dragons: A Security Professional’s Guide to...
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
01h 01mExploiting the supply chain
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack