Slopsquatting: When AI Invents Packages Attackers Own

Slopsquatting is the supply-chain attack built for the AI coding era: a language model hallucinates a plausible-sounding package name that has never existed, an attacker registers that exact name on npm or PyPI, and the next developer — or autonomous coding agent — who copy-pastes the install command pulls the attacker's code straight into the build.

The scale of the raw material is what makes this different from every squatting attack before it. The foundational academic study found that 19.7% of packages recommended by code-generating LLMs simply don't exist — more than 205,000 unique fictional names in a single research corpus. And because hallucinations are persistent rather than random, attackers can farm them: run the same prompts, collect the names that repeat, register them, and wait.

This playbook covers what slopsquatting is and who named it, the research numbers that define the attack surface, why registries structurally cannot catch it, the named cases reported so far, how it differs from typosquatting and dependency confusion, and the layered defense — lockfiles, existence verification, provenance, and mandatory human review of agent-generated dependencies — that actually closes the gap.

The term was coined by Seth Larson, Developer-in-Residence at the Python Software Foundation, and popularized by Ecosyste.ms creator Andrew Nesbitt — a portmanteau of "AI slop" and "typosquatting." The mechanics are simple. An AI coding assistant, asked to solve an ordinary problem, confidently suggests importing a package and installing it. The package doesn't exist — yet. A threat actor who knows which names models tend to invent registers one of them, publishes malicious code under it, and from that moment the hallucination resolves. The install command that would have failed with a 404 last week now succeeds, silently, with the attacker's payload.

What elevates this from curiosity to attack class is the automation on both sides. Developers increasingly accept AI-suggested dependencies without manually checking the registry, and autonomous coding agents can run install commands with no human in the loop at all. Socket.dev's editorial team, which published the definitive early analysis in April 2025, argued that slopsquatting is not just a clever term — researchers had demonstrated a serious, emerging threat in an ecosystem already strained by supply-chain complexity and volume.

The foundational dataset comes from "We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs" — Spracklen et al., a joint study by researchers at the University of Texas at San Antonio, Virginia Tech, and the University of Oklahoma. The team tested 16 code-generation models, commercial and open-source, generating 576,000 Python and JavaScript code samples across 30 test runs. The headline result: 19.7% of all recommended packages were hallucinated, producing more than 205,000 unique non-existent package names.

The spread between model families is the operationally important detail. Commercial models averaged a 5.2% hallucination rate; open-source models averaged 21.7% — roughly a 4x gap. GPT-4 Turbo posted the study's best rate at 3.59%, while CodeLlama 7B and 34B hallucinated in over a third of their outputs. VentureBeat's July 2026 coverage separately cites DeepSeek at 13.63% — note that this is a single-model rate from the same comparative dataset, not a category average, so it sits comfortably inside the 21.7% open-source mean rather than contradicting it. The same coverage reports the roughly 4x proprietary-vs-open gap has persisted into 2026.

Two secondary findings sharpen the risk picture. Higher temperature settings — the randomness dial many teams turn up for "creativity" — increased hallucination rates, to the point where some models generated more fake packages than real ones. And verbose models that recommend more unique packages per answer hallucinated more. If your team runs open-source models at high temperature for code generation, you are operating at the worst corner of this distribution.

Registries and security scanners caught up to typosquatting by measuring string distance: a package one keystroke away from a popular name is suspicious by construction. Slopsquatting breaks that model. The Spracklen team's Levenshtein-distance analysis found only 13% of hallucinated names were simple off-by-one typos. 38% had moderate similarity to real packages, and nearly half — roughly 49% — were highly dissimilar: fully fabricated names that are nonetheless contextually believable, because the model composed them from the naming conventions of the ecosystem.

The persistence data is what turns a quality problem into an attack surface. Re-running 500 hallucination-triggering prompts ten times each, 43% of hallucinated packages repeated in every single run, 58% repeated in more than one run, and 39% never reappeared. A stable minority of hallucinations behaving like deterministic output means an attacker doesn't need luck — they can enumerate the names a popular model reliably invents and register the most convincing ones.

One partial bright spot from the same research: some models can detect their own hallucinations with over 75% accuracy when asked to review their prior output — GPT-4 Turbo and DeepSeek performed best at this. Self-review is a useful mitigation layer, and it maps directly onto how agentic pipelines should be built: a verification pass over generated dependencies before anything is installed. But 75%+ accuracy still leaves a meaningful miss rate, which is why it belongs inside a layered defense rather than as the defense.

How much of this is theoretical? A February 2026 write-up from Aikido Security documents named real-world cases. One caveat we apply deliberately: these incidents come from a single vendor source and have not been independently cross-confirmed in our research pass, so treat the specifics — download counts, repository spread — as Aikido's reporting as of February 2026, not as continuously verified figures.

The huggingface-cli case is the cleanest illustration of the mechanic, because the correct command was never a package install at all — it is pip install -U "huggingface_hub[cli]". The model collapsed a CLI extra into a package name that sounded right, and tens of thousands of installs followed. The react-codeshift case adds the agentic twist: the fake name propagated through instructions that AI agents themselves had written into repositories, creating a loop where machine-generated documentation feeds machine-executed installs with no human checkpoint in between.

Most coverage explains slopsquatting in isolation. The more useful exercise is laying the three squatting-family vectors side by side, with the column that matters most: what the registry can actually detect, and the specific control that closes each gap. The verdicts below synthesize Socket.dev and VentureBeat's attack definitions with npm's provenance documentation and Trend Micro's mitigation guidance.

The pattern the table exposes: each generation of squatting attack moved the exploitable error one step further from the registry's field of view. Typosquatting exploits a keystroke the registry can approximately model. Dependency confusion exploits resolution order the registry never sees. Slopsquatting exploits a hallucination that happened inside a model's forward pass — there is nothing on the registry side to inspect until the attacker registers the name, at which point it looks like any other new package. One adjacent vector worth distinguishing: the AsyncAPI npm attack of July 14, 2026 trojanized four legitimate, established packages — a compromise of real supply, not a registration of fake supply. Different vector, overlapping defense stack.

No single control stops slopsquatting, because the attack spans model output, developer behavior, and registry state. The stack below is sequenced by effort-to-payoff — the first two layers need no new tooling, only discipline in files and commands your team already uses.

The agent-side story matters just as much as the registry-side one. Recent Trend Micro research frames the core failure modes as context-gap filling and surface-form mimicry: agents compose plausible package names either by filling in what they assume must exist, or by statistically following naming conventions, without verifying against a real registry. The same research notes that even advanced coding agents with MCP-backed, real-time validation — Claude Code CLI, OpenAI Codex CLI, Cursor — reduce but do not eliminate phantom-dependency risk, because validation cannot catch every edge case. That is the design argument for Layer 4: the human review gate exists precisely for the residue the automated layers miss. Teams formalizing this should fold it into their broader enterprise vibe-coding security practices rather than treating it as a standalone rule.

The adoption math is what gives slopsquatting its trajectory. Per a 2025 State of Code survey cited by VentureBeat, over 40% of code committed by developers using AI tools is estimated to include AI assistance, and 72% of those who have tried AI coding tools use them daily. Meanwhile a 2026 vulnerability-lifecycle study of 31,267 vulnerabilities across 14,675 packages in 10 languages found reported vulnerabilities growing at roughly 98% per year — far outpacing the roughly 25% annual growth in open-source package counts — with an 85% increase in average vulnerability lifespan. More AI-authored code, flowing into an ecosystem whose vulnerability curve is already steepening, with a dependency channel the registry cannot police by similarity: that is the compounding structure.

Our read of the trend: slopsquatting inverts the economics that kept typosquatting a nuisance rather than a crisis. A typosquatter guesses at human error; a slopsquatter reads a distribution. Because 43% of hallucinated names repeat deterministically, the attacker's targeting problem is solved by the models themselves — and every increment of agent autonomy removes another human checkpoint between the hallucination and the install. The react-codeshift pattern, where agent-authored instructions seeded fake names across 237 repositories, is the early shape of that loop.

Looking forward, expect the verification burden to migrate into the agent toolchain itself: registry-existence and package-age checks as first-class tool calls, provenance verification in CI by default, and agent frameworks shipping install-gating policies the way browsers ship safe-browsing lists. The self-review finding — models catching their own hallucinations at better than 75% accuracy — suggests the cheapest near-term win is architectural: make every agent second-guess its own dependency suggestions against the live registry before the install step, and escalate anything new or low-history to a human. How platform vendors structure disclosure and hardening incentives around agent security — AI agent security and bug-bounty programs included — will shape how fast that becomes standard. For teams building agentic development pipelines now, this is exactly the class of guardrail our AI transformation engagements design in from day one rather than bolting on after an incident.