Slop-Scan was created by Erayaha to address an emerging vulnerability in the modern AI-assisted software development lifecycle: AI package hallucination and slopsquatting. As developers increasingly incorporate code generated by AI models, non-existent package recommendations can be registered by malicious actors to compromise developer workstations and production build systems.
When an AI model suggests a plausible but non-existent package name in installation instructions or imports, attackers monitor these patterns, register the vacant package names on public package registries, and publish malicious versions containing remote access trojans, crypto miners, or credential stealers. Slop-Scan verifies every referenced package against live registry metadata before installation commands are executed.
Slop-Scan is released under the permissive MIT License. It operates with zero vendor lock-in, requires no API keys for standard use, and integrates cleanly into existing GitHub Actions, GitLab CI, and pre-commit hooks.