Your AI assistant just recommended a package that doesn't exist. An attacker has already registered it.

The edition of the Cloud-Native Digest digs into the supply chain threat that's growing directly because of LLM adoption.

What we cover:
→ Slopsquatting demystified, the attack technique your security team needs to know.
→ How typosquatting is being turbo-charged by AI code generation at scale.
→ Detection strategies: OSV.dev API, registry-level allow-listing, and dependency pinning.
→ The 3 policy controls that would have stopped the last 5 major npm package attacks.

If your team uses AI coding tools and you don't have upstream proxy controls in place for your package registries, this digest is required reading.

Full edition here: https://cloudsmith.com/campaigns/cloud-native-digest-newsletter-subscribe

What's your team's current approach to vetting AI-recommended packages? Genuinely curious what others are doing.