Slopsquatting: the AI hallucinated an npm package and an attacker registered it

Vibe coding (any tool) Moderate 15-45 minutes to vet; hours if compromised security critical Last verified Jul 17, 2026

The fix Treat any package name an AI suggested as unverified. Before installing, check it on npmjs.com or pypi.org: downloads, publish date, maintainer, linked repo. A 404 on install means the name was hallucinated; do not guess a fix. If you already installed a suspect package, assume compromise: remove it, rotate every secret in that environment, and audit your lockfiles.

Symptoms

npm install or pip install 404s on a package the AI confidently imported; it never existed
Worse: the install succeeds, because an attacker pre-registered the hallucinated name with a malicious package
A postinstall script exfiltrates your .env, tokens, or wallet keys
The suspect package is brand new, has a generic name, and matches an AI suggestion exactly

Why it happens

LLMs hallucinate plausible package names at scale

A 2.23-million-sample study across 16 code models found 19.7% of generated samples referenced at least one nonexistent package: 21.7% for open-source models, 5.2% for commercial ones.

The hallucinations are predictable, which makes them exploitable

43% of hallucinated names recurred on every one of ten repeat runs. Attackers harvest the recurring names and register them on npm or PyPI before you ever run the install.

It is a documented, active attack

A researcher's empty 'huggingface-cli' decoy on PyPI drew about 30,000 downloads in three months after LLMs kept recommending it. In January 2026 the hallucinated npm name react-codeshift was weaponized and spread through 237 repositories via AI-generated agent skill files. Seth Larson of the Python Software Foundation coined the term 'slopsquatting' for this typosquatting variant.

How to fix it

Vet every AI-suggested package you don't already knowBefore installing, look it up on npmjs.com or pypi.org: weekly downloads, publish date, maintainer history, and the linked repo. A brand-new package with a generic name that matches an AI suggestion is the red flag.
Treat an install 404 as a hallucination signalDo not 'fix' the name by guessing variants until one installs; that is exactly how a slopsquatted package gets in. Search for what the real library is actually called and import that instead.
If you already installed a suspect package, assume compromiseMalicious packages in documented cases used postinstall scripts to exfiltrate .env files, tokens, and wallet keys. Remove the package, then rotate every secret that existed in that environment.
Install defensively while vettingUse `npm install --ignore-scripts` when evaluating an unknown package so nothing runs on install, and use lockfiles with pinned versions so a name registered later cannot slip into a future install.
Add supply-chain scanning to CITools that score package reputation and age (Socket.dev, Snyk, npm audit) flag low-reputation new dependencies automatically, which is exactly the slopsquatting profile.

How to prevent it

Prompt agents to prefer well-known libraries and to justify every new dependency
Review the dependency diff of AI-generated changes as carefully as the code
Pin versions in lockfiles so later registrations can't slip in
Keep reputation-scoring scanners like Socket.dev or Snyk in CI
Never guess-and-retry package names after a 404

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

SocketFree for open source

The best defense against slopsquatting: it flags typosquats, brand-new or suspicious packages, and install-script malware in your pull requests, which is exactly the risk when an AI invents a package name an attacker already registered.

Try Socket →

Snykfree tier

Snyk Code catches injection and XSS right in your editor, and Snyk Open Source flags vulnerable and malicious packages. It covers several AI-code failure modes at once and is free for open source.

Try Snyk →

Frequently asked questions

What is slopsquatting?

Slopsquatting is a supply-chain attack where attackers register package names that AI models hallucinate, so a developer who installs the nonexistent package the AI suggested gets malware instead of a 404. The term was coined by Seth Larson of the Python Software Foundation as a variant of typosquatting. It works because the hallucinations are predictable: in one study, 43% of hallucinated names recurred on every one of ten repeat runs.

How often do AI models hallucinate package names?

A 2.23-million-sample study across 16 code models found that 19.7% of generated samples referenced at least one package that does not exist. Open-source models hallucinated packages in 21.7% of samples, commercial models in 5.2%. Because 43% of the hallucinated names recurred consistently across repeat runs, attackers can harvest and register them in advance.

npm install returns a 404 on a package the AI suggested. What now?

Treat the 404 as a hallucination signal, not a typo. The package most likely never existed, so do not guess name variants until one installs; that guessing is exactly how slopsquatted malware gets in. Search for the real library that provides the functionality and vet it on npmjs.com (downloads, publish date, maintainer, linked repo) before installing.

What should I do if I already installed a hallucinated package?

Assume compromise. Documented slopsquatting packages used postinstall scripts to exfiltrate .env files, tokens, and wallet keys, so remove the package and rotate every secret that existed in that environment. Then audit your lockfile for other unknown dependencies and add a reputation scanner like Socket.dev or Snyk to CI.

Sources

The Vibe Oops briefing

One email when something ships to production that should not have. New incidents, new error guides, no filler.