Slopsquatting is an emerging software supply chain threat made possible by AI hallucinations, where large language model (LLM) hallucinations generate fictitious software package names that threat actors can register and populate with malicious code. This attack vector exploits developers' reliance on AI coding assistants, allowing cybercriminals to inject malware directly into a developer's codebase from day one. Unlike traditional typosquatting, which involves misspelled versions of popular packages, AI recommends plausible-sounding fictitious packages, bypassing existing registry protections. Hallucinations are persistent and severe; one research team analyzed 31,267 vulnerabilities belonging to 14,675 packages across 10 programming languages, discovering that reported vulnerabilities are increasing at an annual rate of 98%, faster growth than the 25% annual increase in the number of open-source software packages. The team also observed an 85% increase in the average lifespan of vulnerabilities, indicating a decline in security. Malicious packages could remain undetected in production for months or even years, allowing threat actors to passively inject malware across countless environments.