Analysis · curated 1 Aug 2026
Slopsquatting: The Supply Chain Attack That Weaponizes AI Hallucinations
First reported · updated · 7 reports dev.to
Coverage timeline
Why it matters
Slopsquatting weaponizes reproducible LLM package hallucinations to bypass the human-typo dependency of typosquatting, meaning developers who trust AI coding assistants can install malicious dependencies without making any error themselves.
An explainer on "slopsquatting," a software supply-chain attack in which attackers register package names that code-generating LLMs hallucinate and recommend, so developers install attacker-controlled packages by faithfully copying an AI assistant's confident but fabricated suggestion. The piece synthesizes the USENIX Security 2025 study "We Have a Package for You!" (arXiv:2406.10279), noting 19.7% of recommended packages did not exist across 576,000 samples and that 43% of hallucinated names reappeared on every re-run, making them reliable targets to register.
Summary
'Slopsquatting' is an emerging software supply-chain attack that weaponizes AI 'package hallucinations' — the tendency of code-generating LLMs to confidently recommend plausible-sounding but non-existent software packages. Attackers monitor AI outputs, register the hallucinated names in public registries with malicious code, and compromise developers who later install those suggested dependencies.[0]
The threat is grounded in measured research rather than a single named campaign. Academic evaluation across 16 LLMs and 576,000 code samples found hallucinated-package rates of at least 5.2% for commercial models and 21.7% for open-source models, with 205,474 unique hallucinated package names, underscoring the scale of the attack surface available to slopsquatters.[17][40]
A 2023 proof-of-concept by researcher Bar Lanyado demonstrated the risk in practice: an empty package uploaded under a hallucinated name ('huggingface-cli') received over 30,000 downloads in three months, showing that developers do install AI-suggested phantom dependencies.[0]
This dossier is guidance-oriented analysis: it explains the mechanism and cites peer-reviewed measurement work, but the evidence does not establish an observed in-the-wild slopsquatting campaign or a named threat actor.[0][7]
Attack chain
- AI hallucination: A developer asks an AI coding assistant for help and the model confidently suggests a package that does not exist in any registry.[0]
- Developer integration: The developer unknowingly includes the fictional package reference in their code or dependency manifest.[0]
- Malicious registration: Attackers monitor AI outputs, identify commonly hallucinated names, and register those package names in public registries with malicious payloads.[0]
- Compromise: When the developer later resolves and installs dependencies, they unknowingly download and execute the attacker's malicious code.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2021-2022 | Package hallucination emerges prominently alongside widespread adoption of AI coding assistants such as GitHub Copilot and ChatGPT.[0] |
| 2023 | Bar Lanyado's experiment uploads the empty 'huggingface-cli' package to simulate a hallucinated name and measures LLM hallucination rates; the term 'AI package hallucination' is first identified.[0] |
| 2024-06-12 | 'We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs' first submitted to arXiv (later revised March 2025, to appear at USENIX Security 2025).[17][40] |
| 2025-01-31 | 'Importing Phantoms: Measuring LLM Package Hallucination Vulnerabilities' submitted to arXiv.[7] |
How it works
LLMs generate phantom packages through statistical pattern recognition: they learn naming conventions (prefixes like react-/@types/, suffixes like -utils/-core, and casing styles) from millions of real package names and extrapolate plausible but fictional combinations such as 'crypto-secure-hash' or '@utils/string-helper'.[0]
The core weakness is the absence of real-time validation — during generation models cannot verify a package's existence against live registries like npm, PyPI, or crates.io, so they rely on statistical likelihood, producing false confidence in non-existent dependencies. Hallucinated outputs also include typosquatted misspellings, non-existent version numbers, and cross-ecosystem confusion.[0]
Research indicates hallucination propensity is not fixed: it varies with model choice, programming language, model size, and task specificity, and shows an inverse correlation with the HumanEval coding benchmark, giving a heuristic for how likely a model is to hallucinate packages.[7]
Key takeaways
- Slopsquatting turns a productivity nuisance — AI hallucinated dependencies — into a supply-chain compromise vector by inviting attackers to pre-register the fictional names LLMs commonly produce.[0]
- The attack surface is large and measurable: open-source models hallucinate packages at over 20% in study conditions, and a real hallucinated name attracted tens of thousands of installs, so the risk is empirically demonstrated rather than theoretical.[0][17][40]
- Defenders should treat AI-suggested dependencies as untrusted input, validate them against registries, and enforce SBOM/SCA controls in CI/CD, while model builders can reduce risk through RAG, fine-tuning, and curated package lists.[0][7]
Defensive actions
- Verify every AI-suggested package against authoritative registries before adding it as a dependency and maintain vigilance when integrating AI-suggested dependencies into production.: Slopsquatting depends on developers installing hallucinated names without confirming they correspond to legitimate, trusted packages.[0]
- Generate and maintain SBOMs and integrate software composition analysis (SCA) tooling into CI/CD pipelines to flag unknown or non-existent packages before deployment.: Comprehensive dependency inventories and automated scanning provide visibility into phantom or malicious dependencies that slip past code review.[0]
- Adopt curated/pre-vetted package allowlists and model-side mitigations such as retrieval-augmented generation (RAG), fine-tuning on verified package datasets, and prompt engineering.: Research-backed mitigation strategies significantly reduce package hallucination rates while maintaining code quality, shrinking the attack surface available to slopsquatters.[0][17]