Your AI Agent Just Installed Malware

AI agents select dependency versions with known vulnerabilities 50% more often than human developers. They optimize for compatibility and recency, not security posture. When an agent picks a package version, it is choosing the one most likely to make the code work — even if that version has a critical CVE.

LLMs hallucinate package names. They confidently recommend packages that do not exist — yet. Attackers monitor LLM outputs, identify commonly hallucinated names, and register them on npm with malicious payloads. This is called slopsquatting. One slopsquatted package accumulated over 30,000 downloads before detection. Research shows commercial LLMs hallucinate package names in 5.2% of code generation responses.

Autonomous agents ship code without human review. When a human developer adds a dependency, there is at least a chance someone notices it in a PR review. When an agent adds one in the middle of a multi-step task, there is no natural review point. The dependency is installed, the tests pass, the PR is opened, and the code ships.

Every package is checked against Socket.dev's malware intelligence feed. Known malicious packages — including slopsquatted names with exfiltration payloads — are blocked before they reach your machine. When the axios@1.14.1 attack shipped a RAT payload via a compromised maintainer account, malware detection caught the signature.

Newly published packages are quarantined for a configurable window (default: 7 days). This is the single most effective defense against slopsquatting. When an attacker registers a hallucinated package name, it is brand new — zero history, zero downloads, zero community vetting. The first_seen rule blocks it automatically. It also caught the flatmap-stream payload in the event-stream attack — a package created specifically for that compromise.

Warns when a package version is published by a different maintainer than previous versions. Account takeovers are the most common vector for compromising popular packages. When a trusted package suddenly has a new publisher, that is a signal worth investigating — especially when the change happens on a package your AI agent chose without consulting you.

Detects packages with lifecycle scripts (preinstall, install, postinstall). Install scripts are the primary delivery mechanism for npm malware — they execute arbitrary code during npm install, before any scanner has a chance to flag the package. Legitimate packages rarely need them. Malicious packages almost always use them.

Checks every package version against OSV (Open Source Vulnerabilities) data. When an AI agent selects a dependency version with a known CVE — which they do 50% more often than humans — the vulnerability rule surfaces it at install time, not days later in a CI scan that nobody reads.

See every package install across your organization. Which packages were blocked, which triggered warnings, and which passed clean. When an AI agent tries to install something suspicious at 2 AM, you see it in the morning.

Full audit trail of every package request. Searchable, filterable, exportable. Useful for compliance (SOC 2, ISO 27001) and for incident response when you need to know exactly what was installed and when.

Customize which rules are active, whether they block or warn, and set thresholds. Some teams block all packages published in the last 7 days. Others use 30 days. Some block install scripts outright. The rules adapt to your risk tolerance.

Get notified when packages are blocked. Security teams do not need to monitor a dashboard — they receive an email with the package name, the rule that triggered, and the full context of the request.