Slopsquatting: The Supply Chain Attack That Weaponizes AI Hallucinations

Summary

'Slopsquatting' is an emerging software supply-chain attack that weaponizes AI 'package hallucinations' — the tendency of code-generating LLMs to confidently recommend plausible-sounding but non-existent software packages. Attackers monitor AI outputs, register the hallucinated names in public registries with malicious code, and compromise developers who later install those suggested dependencies.^[0]

The threat is grounded in measured research rather than an observed named campaign. Spracklen et al. evaluated 16 LLMs over 576,000 code samples and found hallucinated-package rates of at least 5.2% for commercial models and 21.7% for open-source models, with 205,474 unique hallucinated package names, underscoring the scale of the attack surface available to slopsquatters.^[49][50][23]

A 2026 replication on five frontier models (Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, DeepSeek V3.2) found the inter-model hallucination spread has compressed to 4.62%–6.10% but the threat persists. Crucially, the study isolated 127 names all five models invent identically, and after coordinated disclosure with PyPI Security and Socket, 53 (41 PyPI, 12 npm) remained registrable — a concrete, model-agnostic supply-chain attack surface.^[23]

A 2023 proof-of-concept by researcher Bar Lanyado demonstrated the risk in practice: an empty package uploaded under a hallucinated name ('huggingface-cli') received over 30,000 downloads in three months, showing that developers do install AI-suggested phantom dependencies.^[0]

This dossier is research- and disclosure-oriented: the evidence explains the mechanism and cites peer-reviewed measurement and a coordinated disclosure, but does not establish an observed in-the-wild slopsquatting campaign or a named threat actor.^[0][23]

Attack chain

1. AI hallucination: A developer asks an AI coding assistant for help and the model confidently suggests a package that does not exist in any registry.^[0]
2. Developer integration: The developer unknowingly includes the fictional package reference in their code or dependency manifest.^[0]
3. Malicious registration: Attackers monitor AI outputs, identify commonly hallucinated names, and register those names in public registries such as PyPI or npm with malicious payloads.^[0]
4. Compromise: When the developer later resolves and installs dependencies, they unknowingly download and execute the attacker's malicious code.^[0]

Disclosure timeline

How it works

LLMs generate phantom packages through statistical pattern recognition: they learn naming conventions (prefixes like react-/@types/, suffixes like -utils/-core, and casing styles) from millions of real package names and extrapolate plausible but fictional combinations such as 'crypto-secure-hash' or '@utils/string-helper'.^[0]

The core weakness is the absence of real-time validation — during generation models cannot verify a package's existence against live registries like npm, PyPI, or crates.io, so they rely on statistical likelihood, producing false confidence in non-existent dependencies. Hallucinated outputs also include typosquatted misspellings, non-existent version numbers, and cross-ecosystem confusion.^[0]

Research indicates hallucination propensity is not fixed: it varies with model choice, programming language, model size, and task specificity, and shows an inverse correlation with the HumanEval coding benchmark, offering a heuristic for how likely a model is to hallucinate packages.^[41]

Peer-reviewed measurement confirms the phenomenon is systemic rather than anecdotal, and 2026 replication shows the most dangerous property is model-agnostic overlap: a set of names that multiple independent frontier models invent identically creates a predictable, registrable attack surface that no single-model study can reveal, with a Jaccard-similarity peak (J = 0.343) between DeepSeek V3.2 and GPT-5.4-mini suggestive of shared training-data origins.^[49][50][23]

Affected versions and patch status

Key takeaways

• Slopsquatting turns a productivity nuisance — AI hallucinated dependencies — into a supply-chain compromise vector by inviting attackers to pre-register the fictional names LLMs commonly produce.^[0]
• The attack surface is large, measurable, and persistent: even as frontier-model hallucination rates fell to roughly 4.62%–6.10% by 2026, researchers still isolated 53 names registrable by an attacker across PyPI and npm, and a real hallucinated name previously attracted tens of thousands of installs.^[0][23]
• The most defensively significant finding is model-agnostic overlap: names that many independent models hallucinate identically are the most predictable and dangerous, so defenders should treat AI-suggested dependencies as untrusted input, validate them against registries, and enforce SBOM/SCA controls in CI/CD.^[23][49]

Defensive actions

• Verify every AI-suggested package against authoritative registries before adding it as a dependency and maintain vigilance when integrating AI-suggested dependencies into production.: Slopsquatting depends on developers installing hallucinated names without confirming they correspond to legitimate, trusted packages.^[0]
• Generate and maintain SBOMs and integrate software composition analysis (SCA) tooling into CI/CD pipelines to flag unknown or non-existent packages before deployment.: Comprehensive dependency inventories and automated scanning provide visibility into phantom or malicious dependencies that slip past code review.^[0]
• Adopt curated/pre-vetted package allowlists and model-side mitigations such as retrieval-augmented generation (RAG), fine-tuning on verified package datasets, and prompt engineering.: Research-backed mitigation strategies significantly reduce package hallucination rates while maintaining code quality, shrinking the attack surface available to slopsquatters.^[0][49]

Changelog

• Added a 2026 frontier-model replication study (Churilov) showing package hallucination rates have compressed to 4.62%–6.10% across five frontier LLMs, and — more significantly — identifying 53 hallucinated package names (41 PyPI, 12 npm) that remain registrable by an attacker after coordinated disclosure with PyPI Security and Socket, establishing a concrete, model-agnostic supply-chain attack surface not present in the prior intelligence picture.^[23]
• Reassessed archetype from guidance to vuln-research to reflect that the corroborating evidence is dominated by academic measurement, a proof-of-concept, and a coordinated vulnerability disclosure rather than defensive guidance.^[23][49]