AI Generates Fake Package Names: The Risk of Slopsquatting

What happened?

Researcher Aleksandr Churilov has discovered that five state-of-the-art language models — Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2 — hallucinate exactly the same 127 package names for the PyPI and npm repositories. Of these, 53 (41 on PyPI and 12 on npm) have not yet been registered, making them perfect targets for slopsquatting attacks. This finding, published in the preprint The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort (arXiv:2605.17062, not yet peer-reviewed), represents a significant evolution from previous studies: while isolated hallucinations in individual models were documented in 2024, an alarming convergence is now observed among leading code assistants. Churilov points to two main causes: on one hand, the models may have learned the same incorrect references from shared public training material, such as outdated tutorials and documentation; on the other, they may independently extrapolate plausible names from ecosystem conventions (e.g., prefixes like py- or node-), generating matches that seem legitimate but do not exist.

Why is it important?

Slopsquatting is an emerging threat where attackers register packages with names that AI assistants falsely suggest to developers. If a developer trusts the AI's recommendation and installs the package, they could be introducing malicious code into their project. The consistency across models suggests that hallucinations are not random but stem from shared training data or ecosystem conventions. This phenomenon differs from classic typosquatting (which exploits typos) and dependency confusion (which leverages internal vs. public names), as the attack vector here is generative AI itself. According to the study, the consistency among models indicates a systemic problem: if an attacker registers those 53 names, any developer using one of these assistants could be a victim, regardless of the model they use. Moreover, the risk is magnified because developers tend to trust AI suggestions, especially when they come from tools integrated into their IDE. So far, no attack using these names has been reported, but the window of opportunity is open, and time to act is limited: once registered, malicious packages can remain undetected for months.

Consequences for companies and developers

For companies, the risk is real: a malicious package could compromise an entire software supply chain. Security teams must manually verify any AI recommendation before installing dependencies. Additionally, repository administrators like PyPI and npm should consider preventive measures, such as blocking AI-generated names until they are reviewed. The potential impact is enormous: according to Sonatype data, over 700,000 malicious packages were registered in public repositories in 2025, and slopsquatting could accelerate this trend. For individual developers, the recommendation is clear: never run pip install or npm install without first searching for the package in the official registry and verifying its popularity, creation date, and maintainer reputation. Companies should implement dependency control policies, such as using private mirrors or security analysis tools that compare package names against known hallucination lists. Churilov suggests that AI providers should collaborate to share lists of hallucinated names and update their models to reject suggestions for unverified packages. Meanwhile, the open source community can help by preemptively registering vulnerable names as honeypot packages or marking them as untrusted.

What should readers know?

• Don't blindly trust package suggestions from your code assistant.
• Always verify the existence and reputation of a package before installing it.
• The 53 identified names are available in the original study; repository administrators are advised to temporarily block them.
• So far, no attack using these names has been reported, but the window of opportunity is open.
• This problem is not limited to Python and JavaScript: similar studies have found hallucinations in Rust (crates.io), Go (pkg.go.dev), and other ecosystems.

“The consistency in hallucinations across models suggests the problem is systemic and requires a coordinated solution between AI developers and repository maintainers,” warns Churilov. “It is not an isolated failure of one model, but a pattern emerging from training data and ecosystem conventions.”

In conclusion, slopsquatting represents a new frontier in software cybersecurity, where AI not only helps write code but can also be manipulated to introduce vulnerabilities. The technical community must act quickly to close this window of opportunity before attackers exploit it. The solution lies in a combination of best development practices, automated verification tools, and collaboration among ecosystem actors.