Slopsquatting: How AI Hallucinated Packages Become Malware

Summary

Slopsquatting is an emerging software supply-chain threat in which attackers register package names that AI coding agents hallucinate. When an agent operating in an auto-approval mode decides it needs a dependency and confidently invokes an install command for a non-existent (but attacker-registered) package, the malicious code is pulled in and executed before a human can review it.^[0]

The threat is practical because hallucinations are repeatable and predictable: cited research reports that roughly one in five recommended packages do not exist and that a large share of hallucinated names recur consistently, letting attackers enumerate and pre-register the names most likely to be requested.^[0]

A 2026 replication study on frontier models finds hallucination rates have compressed to 4.62%-6.10% but persist, and - crucially - that a set of package names is invented identically across multiple vendors' models, leaving dozens registrable even after registry defenses. This model-agnostic overlap is the core reason no single-model study can bound the exposure.^[28]

Academic work extends this into 'adversarial hallucination squatting,' showing attackers can compute an LLM's hallucination distribution for trending resources, register those names to host adversarial prompts, and achieve remote tool execution and remote code execution against production LLM applications with integrated terminals - potentially at botnet scale. This lands against a backdrop of intentionally malicious packages already making up a large share of ecosystem vulnerability reports.^[49][40]

How it works

AI coding assistants such as Claude or GPT, when generating code, sometimes hallucinate the name of a needed dependency and run an install command (e.g. 'composer require laravel-official/nightwatch'). If the hallucinated package name has been registered by an attacker, the agent installs and executes it automatically, especially when operating in an auto-approval mode without human review.^[0]

The attack is reliable because hallucinations are consistent: cited research reports 19.7% of recommended packages do not exist, 43% of hallucinated names repeat every time, and 58% repeat across multiple runs, so attackers can enumerate likely hallucinations and pre-register matching packages.^[0]

A 2026 replication across five frontier models measured overall hallucination rates of 4.62%-6.10% and identified 127 package names invented identically by all five models; 53 of these remained registrable after existing registry defenses, meaning an attacker can target names that are hallucinated model-agnostically rather than betting on a single model's quirks.^[28]

In the adversarial-hallucination-squatting variant, attackers select trending resources (popular repositories, skills), compute the LLM's distribution of hallucinated names for them, and preemptively register those names to host adversarial prompts. Because hallucinations transfer across foundational models and application layers, this scales into untargeted promptware and demonstrated remote tool execution and remote code execution against production LLM applications with integrated terminals.^[49]

Affected versions and patch status

Key takeaways

• Slopsquatting turns the predictable, repeatable nature of AI package-name hallucinations into a reliable supply-chain attack vector against agentic development workflows.^[0]
• Hallucination rates on 2026 frontier models have compressed (4.62%-6.10%) but the threat remains, and the danger is amplified by names that multiple vendors' models invent identically - dozens of which stay registrable even after registry defenses.^[28]
• Because hallucinations transfer across models and can yield remote code execution in production LLM applications, defenders should treat AI-driven dependency installation as an untrusted action requiring human verification and controls.^[49][0]
• Malicious packages already make up a large share of ecosystem vulnerability reports (49% in NPM, 14% in PyPI) amid a 98% annual surge in OSS vulnerabilities, underscoring that package repositories are an actively targeted attack surface that AI hallucinations further amplify.^[40]

Defensive actions

• Configure AI coding agents to require explicit human approval before running package-install commands such as composer or npm.: Auto-approval modes let agents install hallucinated (and attacker-registered) packages without any human check, so requiring approval blocks automatic execution of malicious dependencies.^[0]
• Do not blindly approve installs; manually inspect each package's popularity, maintenance activity, and last update before allowing installation.: Slopsquatted packages are typically newly created and unpopular, so vetting these attributes helps distinguish legitimate dependencies from attacker-planted ones.^[0]
• Enable a Minimum Release Age setting to block installation of packages created very recently.: Slopsquatting packages are commonly registered right after a hallucination is identified, so refusing freshly created packages defeats that timing.^[0]
• Research and select dependencies before tasking the agent, then manually verify the package the agent selects.: Deciding on packages in advance removes reliance on the agent's hallucination-prone recommendations and gives time to properly vet options.^[0]