Slopsquatting: When AI Invents Package Names Attackers Register
On this page
The model's confident wrong answer isn't just embarrassing — attackers can register it and ship malware.
| When | 2024–2025 |
|---|---|
| Target | Software supply chain (PyPI / npm) |
| Researchers | Spracklen et al. (USENIX '25); Lanyado (Lasso) PoC |
| Finding | ~19.7% of recommended packages hallucinated; predictable + repeatable |
| Impact | Attacker-registerable names → malware (a benign PoC drew 15k+ installs) |
- 1A code assistant recommends installing a plausible-sounding package
- 2The package doesn't exist — but the hallucinated name is predictable and recurs
- 3An attacker registers that name with malware; developers install it
What happened
Code-generating LLMs frequently recommend software packages that don't exist. A USENIX Security 2025 study of 576,000 samples across 16 models found 19.7% of recommended packages were hallucinated — 205,474 unique non-existent names, many plausible look-alikes of real packages. Separately, Lasso's Bar Lanyado registered one name LLMs repeatedly hallucinated (“huggingface-cli”), which drew 15,000+ downloads and was even referenced in a real project's install instructions.
How it becomes an attack
Because the hallucinated names are predictable and recur across prompts, an attacker can pre-register them with malicious code — “slopsquatting.” A developer who trusts the assistant's install command pulls the attacker's package.
Root cause
Overreliance on confident model output for dependencies, combined with a supply chain where anyone can register a name.
What a control would catch
Verifying that a recommended package actually exists and is the intended, reputable one — before install — defeats the attack, as do lockfiles and allowlists.
How to prevent it
- Verify every dependency exists and is the right one before installing.
- Use lockfiles, allowlists, and private mirrors.
- Don't blindly run an assistant's install commands.
Feel it yourselfThe replay lab gets an assistant to recommend a hallucinated package name — the slopsquatting class.
FAQ
What is package hallucination?
When a code assistant confidently tells you to install a package that doesn't exist. A USENIX Security 2025 study of 576,000 samples found 19.7% of recommended packages were hallucinated — 205,474 unique fake names.
How does it become an attack?
The hallucinated names are predictable and recur, so an attacker registers them with malicious code. A researcher registered one repeatedly-hallucinated name (“huggingface-cli”) as a benign PoC and it drew 15,000+ downloads.
How do developers defend?
Verify every dependency exists and is the intended one before installing; use lockfiles and allowlists; don't blindly run an assistant's install commands.
Sources
- We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs — USENIX Security 2025
- AI bots hallucinate software packages and devs download them — The Register
- The Rise of Slopsquatting: How AI Hallucinations Are Fueling a New Class of Supply Chain Attacks — Socket