·The mirago team
What Is Slopsquatting? The AI Supply-Chain Attack, Explained
Slopsquatting is a new supply-chain attack that weaponises the package names AI coding tools hallucinate. Here's how it works and how to defend against it.
Read →The mirago blog
Writing & updates
Notes on hallucinated packages, slopsquatting, supply-chain safety, and what's new in mirago.
·The mirago team
Why AI Coding Tools Invent Python Packages That Don't Exist
AI assistants regularly import Python packages that were never real. Here's why package hallucination happens — and why it isn't going away.
Read →·The mirago team
Catch Hallucinated Imports Before You pip install
A practical walkthrough: how to find AI-invented Python imports in seconds with mirago, before they ever reach pip install.
Read →·The mirago team
Package Hallucination in 2026: What the Research Shows
How often do AI models invent package names, how is it measured, and what does the 2026 picture look like? A grounded look at package hallucination.
Read →·The mirago team
Securing Your Python Supply Chain Against AI-Generated Dependencies
AI assistants are now a major source of new dependencies. Here's how to harden your Python supply chain against the risks they introduce.
Read →·The mirago team
Add mirago to CI: Block Fake Imports on Every Pull Request
Make import-checking automatic. Here's how to run mirago in GitHub Actions so an AI-invented package fails the build before it merges.
Read →·The mirago team
Typosquatting vs Slopsquatting: What's the Difference?
Typosquatting bets on your typos; slopsquatting bets on AI's hallucinations. Here's how the two supply-chain attacks differ — and overlap.
Read →·The mirago team
A Developer's Guide to Safe AI-Assisted Coding in 2026
AI assistants make you faster — and add new failure modes. A practical checklist for shipping AI-generated code safely in 2026.
Read →·The mirago team
5 Signs an AI-Suggested Package Might Be Malicious
Not every real package is a safe one. Five red flags that an AI-suggested PyPI package could be a slopsquat — and how mirago spots them.
Read →·The mirago team
Why 'Fail-Open' Is the Right Default for a Linter
A security tool that cries wolf gets deleted. Why mirago is deliberately conservative — failing open and warning only when signals agree.
Read →