The package doesn't exist yet, but the malware can: AI tools hallucinated 205,000 dependency names

big oops verified Last verified Jul 17, 2026

TL;DR Academic research accepted to USENIX Security 2025 tested 16 LLMs across roughly 576,000 code samples and found that 19.7% of the packages they recommended did not exist. The fake names repeat in predictable patterns, which means an attacker can register them on PyPI or npm with malware and simply wait for a developer to trust the AI's suggestion. The technique earned a name: slopsquatting.

Date: Mar 2025
Tools involved
Impact: 19.7% of AI-recommended dependencies across 576,000 code samples did not exist; researchers catalogued more than 205,000 unique hallucinated package names
Root cause: LLMs invent plausible but nonexistent package names in repeatable patterns, and open registries let attackers pre-register those names with malicious code

What happened

Research presented in 2025 and accepted to USENIX Security 2025 systematically measured package hallucination in AI-generated code. Across 16 LLMs and roughly 576,000 generated code samples, 19.7% of recommended software dependencies did not exist. Open-source models hallucinated far more, about 21.7% on average, versus about 5.2% for commercial models, and some code-specialized models fabricated packages in over a third of their outputs. In total, the researchers catalogued more than 205,000 unique hallucinated package names.

The finding that turns this from a quality problem into a security problem is repeatability. The same nonexistent package name would recur across runs, following predictable patterns: conflations of two real packages, typo variants of real names, and pure fabrications. A hallucination that repeats is a hallucination an attacker can predict.

That is the slopsquatting attack: observe which fake names an AI commonly suggests, register those names on PyPI or npm with malicious code, and wait. Developers who trust the AI's dependency suggestion run the install command, and the attacker's package executes on their machine or ships inside their app.

The work was covered by Socket, Help Net Security, and DevOps.com, and slopsquatting has been catalogued as an emerging threat class. It is the quantitative backbone for treating AI-suggested dependencies as a real-world attack surface rather than a hypothetical one.

Impact

No single breach anchors this entry; the impact is a mapped attack surface of more than 205,000 package names that AI tools will keep suggesting and that anyone can register. At a 19.7% hallucination rate, roughly one in five dependencies recommended by the tested models pointed at a name nobody owns. For teams whose workflow is "paste the AI's install command and move on," every one of those names is a slot an attacker can fill first, and the predictable patterns mean attackers do not have to guess which ones.

Root cause

LLMs generate package names the same way they generate everything else: by producing plausible text, with no lookup against a real registry to confirm the package exists. Because the errors follow patterns (mashups of two real packages, typos, and recurring fabrications), the same fake names come back run after run. Combine repeatable fake names with registries like PyPI and npm that let anyone claim an unregistered name, and the hallucination becomes a supply-chain vulnerability with a waiting attacker on the other end.

How to not be this entry

Verify that every AI-suggested package actually exists and is the package you think it is before installing. Check the registry page, the publish history, and the download counts, not just the name. Read the fix guide: Slopsquatting: the AI hallucinated an npm package and an attacker registered it
Never paste an AI-generated install command straight into your shell. Read the dependency list first; a name you have never heard of deserves thirty seconds of scrutiny.
Be extra skeptical of dependency suggestions from open-source and code-specialized models, which hallucinated at the highest rates in the study (about 21.7% on average, and over a third for some models).
Audit AI-generated code for other silent defaults while you are at it; invented packages rarely travel alone. Read the fix guide: SQL injection and XSS in AI-generated code

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

SocketFree for open source

The best defense against slopsquatting: it flags typosquats, brand-new or suspicious packages, and install-script malware in your pull requests, which is exactly the risk when an AI invents a package name an attacker already registered.

Try Socket →

Snykfree tier

Snyk Code catches injection and XSS right in your editor, and Snyk Open Source flags vulnerable and malicious packages. It covers several AI-code failure modes at once and is free for open source.

Try Snyk →

Frequently asked questions

What is slopsquatting?

Slopsquatting is a supply-chain attack that exploits AI package hallucinations: an attacker observes which nonexistent package names AI coding tools commonly suggest, registers those names on registries like PyPI or npm with malicious code, and waits for developers to install them. It works because AI hallucinations are repeatable, so the same fake package names recur across many users and sessions.

How often do AI coding tools hallucinate package names?

A study accepted to USENIX Security 2025 found that 19.7% of packages recommended across roughly 576,000 AI-generated code samples did not exist. Open-source models hallucinated packages about 21.7% of the time on average, commercial models about 5.2%, and some code-specialized models fabricated packages in over a third of their outputs.

Why are hallucinated package names dangerous rather than just annoying?

Hallucinated package names are dangerous because they repeat: the study found the same nonexistent names recurring across runs in predictable patterns, such as conflations of two real packages and typo variants. That repeatability lets an attacker pre-register the fake name with malware, so the next developer who trusts the AI's suggestion installs the attacker's code instead of getting a harmless 404.

How do I protect my project from slopsquatting?

Treat every AI-suggested dependency as unverified until you have confirmed it on the registry yourself: check that the package exists, that its publish history and download counts look legitimate, and that the name is not a near-miss of the package you actually wanted. Never run an AI-generated install command without reading it, and apply extra scrutiny to suggestions from open-source or code-specialized models, which hallucinate at the highest rates.

Sources

The Vibe Oops briefing

One email when something ships to production that should not have. New incidents, new error guides, no filler.