What Is Slopsquatting (AI Package Hallucination Attacks)?

Quick answer

• Slopsquatting is the attack of registering the package names AI assistants hallucinate, so copied code pulls in malware.
• It exploits the fact that models sometimes invent plausible but nonexistent dependencies.
• The defense is verification: never install a dependency without checking it exists and is legitimate.

What is slopsquatting?

Slopsquatting (a play on “typosquatting” and “AI slop”) is a supply-chain attack that preys on hallucinated software dependencies. When an AI coding assistant generates code, it occasionally references a package that doesn’t exist — a plausible-sounding name it invented. Attackers register those names on public registries ahead of time, so the next developer who copies the generated code installs an attacker-controlled package instead. The Cloud Security Alliance and other researchers have documented this as a growing AI-specific threat.

How it works

The attack has three steps. First, an attacker identifies or predicts package names models tend to hallucinate. Second, they register those names on a registry like npm or PyPI, publishing a package that looks benign but contains malicious code. Third, a developer pastes AI-generated code that imports the fake package, runs install, and executes the attacker’s code — often at install time, with full project permissions.

Why it matters

Slopsquatting turns the trust developers place in AI output into a delivery mechanism for malware. It’s a software supply chain attack with a novel entry point: the hallucination is the vulnerability, and the developer’s copy-paste is the trigger. It’s especially dangerous for vibecoders, who are the audience most likely to install suggested dependencies without checking.

Where this bites vibecoders

This is the most vibecoder-specific threat in the catalog: the attack depends on you trusting a dependency an assistant invented. The habit that defeats it is tedious but simple — look up every package before installing. Confirm it exists, check its download count, repository, and publish date, and prefer well-known libraries over anything with a name you’ve never seen before.

Where AI coding assistants get this wrong

• Importing packages that don’t exist, especially for niche tasks where a real library is less common in training data.
• Suggesting a “well-known” package by a slightly wrong name that an attacker has already registered.
• Generating install commands for dependencies without verifying them against the registry.

Checklist

• Verify every dependency exists on the official registry before installing.
• Prefer widely used, actively maintained packages.
• Check a package’s repository, publish date, and download history for red flags.
• Pin dependencies and review what installs run (post-install scripts are a risk).
• Generate an SBOM so you can see what you actually shipped.

FAQ

How is slopsquatting different from typosquatting?

Typosquatting exploits human typos — reqests instead of requests. Slopsquatting exploits model hallucinations — a package name that never existed at all. Both deliver malicious packages, but the source of the error differs.

How do I check if a package is real?

Search the official registry by name, inspect its metadata (author, repository, version history, weekly downloads), and cross-check the import name against the project’s own documentation. A package with no repository, a brand-new publish date, and zero history is a red flag.

Can this be fully automated away?

Partially. Dependency scanners and lockfiles catch some issues, but they can’t tell a hallucinated-yet-registered package from a legitimate one. Human verification of new dependencies remains the strongest control.

Related topics

• What Is a Software Supply Chain Attack?
• What Is a Software Bill of Materials (SBOM)?
• What Is a Non-Human Identity (NHI)?
• Does AI Still Hallucinate (and Why)?

Sources

• Cloud Security Alliance
• OWASP — Software Supply Chain Security