- AI coding tools hallucinate plausible but non-existent software package names, enabling “slopsquatting” attacks where malicious actors pre-register those names on public repositories like PyPI and npm to deliver malware.
- A study across 576,000 code samples from 16 AI models found that nearly 20% of AI-generated code included hallucinated package names, with over 58% of those names reappearing across multiple runs, making them predictable enough to exploit at scale.
- Open-source LLMs hallucinate package names at roughly 21.7%, compared to around 5.2% for commercial models, meaning teams using open-source AI coding tools face a materially larger attack surface.
A developer trusts an AI coding assistant, runs the suggested install command and unknowingly pulls malware into a production codebase. That is the core mechanics of “slopsquatting,” a supply chain attack vector that exploits AI hallucinations rather than human error. A study testing 16 popular code-generating models across 576,000 samples found nearly 20% of AI-generated code included package names that do not exist, names attackers can register and weaponise before the developer notices anything is wrong.
How Slopsquatting Exploits AI Hallucinations
The term was coined by Python Software Foundation Developer-in-Residence Seth Larson, combining “AI slop” with “squatting.” The mechanic is straightforward. When developers use AI assistants like GitHub Copilot or ChatGPT to generate code, the model may suggest importing a library that does not exist, recommending, say, pip install fastparserx when no such package is available. Attackers identify frequently hallucinated names and register malicious packages under those exact titles on platforms like PyPI or npm. The packages sit dormant until a developer trusts the suggestion and runs the install without checking.
What makes this a practical attack vector rather than a theoretical one is the predictability of the hallucinations. The study found that over 58% of hallucinated package names reappeared across multiple runs, and 43% appeared consistently across ten separate attempts using the same prompt. Attackers do not need to guess; they can test the same prompts developers are likely to use and register whatever the model reliably invents. In 2023, a security researcher registered a hallucinated package named “huggingface-cli” and recorded more than 30,000 downloads in three months.
Real-World Risks and Mitigation
A successful slopsquatting attack can steal API keys and cloud tokens, exfiltrate data, or install backdoors for persistent access. The damage compounds quickly in modern development environments, where a single malicious package can propagate through nested dependencies and affect multiple applications simultaneously. This is the same supply chain exposure that makes AI-generated code quality a growing concern across security teams.
The risk is not evenly distributed. Open-source LLMs hallucinate package names at roughly 21.7%, compared to around 5.2% for commercial models. Teams using open-source AI tools for code generation are facing a materially larger attack surface, and that gap is worth factoring into AI toolchain decisions, particularly for organisations where supply chain integrity is a compliance requirement.
Mitigation requires several layers working together. Real-time package validation, checking whether a recommended package actually exists in the official repository before it is added to a project, is the most direct control. Software Bills of Materials (SBOMs) provide ongoing visibility into dependencies and make it easier to identify compromised components after the fact. Sandboxed environments for testing new dependencies and automated vulnerability scanning add further checkpoints before code reaches production. Developer training matters too: AI-generated package suggestions warrant the same scrutiny as any third-party dependency, regardless of how confidently the model presents them. None of these controls is sufficient alone; the slopsquatting threat is best addressed by combining tooling with process. Stay up to date with the latest AI developments at Auton AI News.
