Slopsquatting: The AI Package Hallucination Attack You're Probably Not Defending Against

I was doing my TryHackMe training this morning, working through the OWASP LLM Top 10 for 2025, when I hit LLM09:2025 — Misinformation. I thought I had this one covered with Sentinel, my AI security proxy. Misinformation detection, hallucination flagging — I'd mapped all of it. Then I went deeper and hit something I hadn't explicitly named: package hallucination. I'd seen it happen. I'd caught it myself because I know PyPI well enough to recognize when a package name smells wrong. But if I hadn'...