Slopsquatting is a supply-chain attack that exploits a specific failure of AI coding assistants: they invent software package names that do not exist, and an attacker registers those names first, so that the next developer who follows the AI’s suggestion installs the attacker’s code. The name was coined by Seth Larson of the Python Software Foundation as a play on typosquatting, where the bait is a human typo. Here the bait is a machine hallucination, and it is both more common and more predictable than a typo, which is what makes it dangerous.
The mechanism matters because the AI does not sound unsure. It recommends a plausible package with total confidence, in the tone it uses for real ones, and in 2026 the developer following that recommendation is increasingly an autonomous agent that installs the dependency without a human ever reading the name. This piece explains how the attack works, what the research actually measured, the real incidents on record, and how to stop it in a modern AI-assisted pipeline.
What is slopsquatting?
Slopsquatting is the practice of registering a package name that a large language model hallucinates, so that the hallucination resolves to malicious code. The attack has three steps. A developer asks an AI assistant for code. The assistant writes an import for a package that was never published, because the model has pattern-matched a name that sounds right. An attacker who has watched which names models invent has already registered that exact name on PyPI or npm, pointing it at their own payload. When the code runs, or when an agent runs it, the malicious package installs.
It is the AI-native cousin of the supply-chain attacks defenders already know. Typosquatting relies on a human fat-fingering “requsts” instead of “requests.” Dependency confusion relies on a public package outranking a private one. Slopsquatting relies on the model itself supplying the wrong name, which removes the need for the attacker to guess what a human might mistype: the model tells everyone the same wrong answer.
How often do AI models hallucinate packages?
Often enough to be a reliable attack surface. The foundational measurement is a University of Texas at San Antonio study presented at USENIX Security 2025, which generated 2.23 million code samples across 16 models and found that 19.7% of them, some 440,000 samples, referenced at least one package that does not exist. Across all of it the researchers catalogued 205,474 unique hallucinated package names, which is 205,474 pieces of free bait waiting to be registered.
The rate splits sharply by model type. Open-source models hallucinated packages 21.7% of the time on average, against 5.2% for commercial models, and some configurations of the CodeLlama family exceeded 33%. GPT-4 Turbo was the cleanest measured at 3.59%. Lower is not safe, only rarer: a 3.59% rate across an organisation that runs thousands of AI-assisted builds a week is still a steady supply of unregistered names.
The finding that turns this from noise into an attack is repeatability. When the researchers ran the same prompt ten times, 43% of hallucinated names came back on every single run, and 58% appeared more than once. Hallucinations are not random. A model tends to invent the same wrong name for the same request, which means an attacker does not have to register hundreds of thousands of names on spec. They can ask a popular model a popular question, note the name it reliably invents, and register that one.
| Measure | Finding |
|---|---|
| Code samples analysed | 2.23 million, across 16 models |
| Samples with a hallucinated package | 19.7% (about 440,000) |
| Unique fake package names | 205,474 |
| Open-source model hallucination rate | 21.7% average |
| Commercial model hallucination rate | 5.2% average |
| Fake names that recurred across 10 identical runs | 43% every run, 58% more than once |
Has slopsquatting actually happened?
Yes, and the clearest cases show how a hallucinated name gains momentum. Security researchers registered huggingface-cli as a proof of concept after finding models recommended it in place of the real tool; it drew more than 30,000 downloads within three months, helped along when Alibaba included the hallucinated command in public documentation. On npm, a hallucinated unused-imports package, invented in place of the real eslint-plugin-unused-imports, was pulling around 233 downloads a week as of February 2026. Neither was weaponised by its finder, but both prove the pipeline: invent, register, and the installs arrive on their own.
The 2026 incidents show the agentic version. A hallucinated react-codeshift package spread through 237 GitHub repositories in January 2026, carried not by humans but by AI-generated agent skill files that referenced it. And the broader supply-chain picture around it is escalating: one industry report found the first half of 2026 produced more than 2.6 times the campaign volume and 4.5 times the package-compromise volume of all of 2025. Slopsquatting is one lane of that traffic, and it is the lane that grows every time coding agents get more autonomy.
// Free tool
How does your own site score?
Run the same forty passive checks against your own domain — TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
Why AI coding agents make this worse
The USENIX study measured suggestions to humans, who at least see the import line. The dangerous shift in 2026 is that the developer is often an agent. An autonomous coding agent tasked with building a feature will write the code, read back its own generated dependencies, and call the package manager to install them, and no step in that loop necessarily touches a human reviewer. The name the model invented is now installed by the same system that invented it.
That closes the one gap the attack used to rely on, a person glancing at the install command. It also raises the stakes of a single bad install, because the agent runs with real credentials. A malicious package’s post-install script executes with access to whatever the agent can see: API keys, cloud credentials, and the model API tokens the agent itself uses. This is the same widening exposure we described in agentic AI threats and MCP security, arriving through the dependency tree instead of the tool call.
How to defend against slopsquatting
The defences are concrete and most of them predate AI, which is the good news. The single most effective control is to verify every AI-suggested package name against the official registry, and against the specific one you mean to install from, before it enters a build. Where an agent installs dependencies, that check has to be automated and blocking, not a human habit, because there is no human in the loop.
- Pin and verify. Commit lockfiles and check installed packages against known-good hashes, so an unexpected name or a changed artefact fails the build rather than shipping.
- Allowlist for agents. Give autonomous coding agents an explicit list of packages they may install, and require human sign-off for anything outside it. This is the control that directly answers the no-human-in-the-loop problem.
- Flag young packages. Treat any dependency first published 30 to 90 days before your first use of it as suspect, because a freshly registered name matching a hallucination is the whole attack.
- Generate an SBOM. Produce a software bill of materials for AI-generated code so every dependency is inventoried and auditable after the fact, the same discipline we recommend in hardening any AI-facing service.
- Tune the model down. Lower temperature settings reduce inventive hallucination, and evaluating a model’s supply-chain safety, not just its coding ability, belongs in any procurement decision.
None of this requires new technology. It requires treating an AI’s package recommendation with the suspicion you would give a stranger’s, and building the check into the pipeline rather than trusting the confidence in the model’s voice. It is the same lesson as vibe coding shipping vulnerabilities at scale: the model is fast and fluent, and neither of those is the same as correct.
Frequently asked questions
What is slopsquatting?
Slopsquatting is a supply-chain attack in which an attacker registers a software package name that an AI coding assistant hallucinates, so that developers or agents who follow the AI’s suggestion install malicious code. The term was coined by Seth Larson of the Python Software Foundation.
How is slopsquatting different from typosquatting?
Typosquatting baits a human typo, such as “requsts” for “requests.” Slopsquatting baits an AI hallucination, a package name the model invents. Because a model tends to invent the same wrong name repeatedly, slopsquatting is more predictable for an attacker than waiting for someone to mistype.
How often do AI models hallucinate package names?
A USENIX Security 2025 study of 2.23 million samples found 19.7% contained a non-existent package. Open-source models averaged 21.7% and commercial models 5.2%. Across identical repeated prompts, 43% of hallucinated names reappeared on every run.
Has slopsquatting happened in the real world?
Yes. A proof-of-concept huggingface-cli package drew over 30,000 downloads in three months, a hallucinated unused-imports package appeared on npm, and a hallucinated react-codeshift spread through 237 GitHub repositories via AI-generated agent files in early 2026.
Why do AI coding agents make slopsquatting worse?
Autonomous agents generate code, resolve their own dependencies and install them without a human reading the package name, removing the review step the attack used to depend on. A malicious package’s install script then runs with the agent’s API keys and cloud credentials.
How do you prevent slopsquatting?
Verify every AI-suggested package name against the official registry before installing, pin and hash-check dependencies with lockfiles, allowlist the packages agents may install, flag packages registered in the last 30 to 90 days, generate a software bill of materials, and use lower model temperatures for code generation.
Sources and further reading
- Cloud Security Alliance: Slopsquatting, AI code hallucinations fuel supply chain attacks (research note, April 2026)
- Spracklen et al., “We Have a Package for You: A Comprehensive Analysis of Package Hallucinations by Code-Generating LLMs,” USENIX Security 2025
- Aikido: slopsquatting, the AI package hallucination attack already happening
- GovTech: slopsquatting in the supply chain, weaponized AI hallucinations
- Related reading on Ransomnews: agentic AI threats and MCP, the MCP attack surface, vibe coding is shipping vulnerabilities at scale, and building a secure MCP server.
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.