The agent needed a rate limiter. It picked one, wrote the import, added it to requirements.txt, and moved on. The name reads like every other package you would install except nobody published it. This hallucinated package can then set off a chain of chaos.
What is a hallucinated package?
A hallucinated package is a software library that an AI coding tool suggests or imports but doesn't exist in the public registry like npm or PyPI. The name looks real and plausible, but nothing is actually published under it.
Most modern applications are built mostly from open source libraries. So a fake dependency slips into a familiar install step without standing out.
The scale is measurable. In a large 2025 study, researchers ran 16 models across 576,000 code samples and found that 440,445 package references (19.7%) were hallucinations, including 205,474 unique non-existent packages.
From hallucination to attack: what slopsquatting is
A hallucinated name is harmless on its own. Slopsquatting makes it dangerous. Slopsquatting is a software supply chain attack that turns AI hallucinations into malware delivery.
The next developer who follows the AI suggestion installs the attacker's package instead of a real one. This is a "pull" attack, because the victim's own tools pull in the harmful code.
Timing is what makes this serious. With open source malware, the damage can begin the moment the package is installed, not later in production. Our Endor Labs research found that 51% of organizations saw suspected or confirmed malware in 2025.
Slopsquatting vs. Typosquatting and Dependency Confusion
Slopsquatting is one of three related supply chain attacks. The table below shows how they're different and how teams catch them.
Key point: Spell-check and name-similarity checks miss slopsquatting because no human mistyped anything. The name is a machine invention, so you need to detect malicious packages by their behavior and provenance, not by how they are spelled.
Why AI coding tools invent package names
Large language models predict plausible text. They do not check a live registry, so they produce names that fit common patterns but were never published.
The invented names are semantically convincing, which is why they are hard to catch by eye. Higher randomness settings in the model make the problem worse.
The pattern is not random noise. A breakdown of how AI invents package names found that about 38% of hallucinated names resembled real packages, 13% were typos, and 51% were completely fabricated.
How common are hallucinated packages?
The rate is high enough to plan around. The Cloud Security Alliance research reviewed the same 2025 study and confirmed that 19.7% of samples contained at least one hallucinated package name.
Two details make these names easy targets. The same fake names recur across repeated prompts, and open source models hallucinate at a higher rate than commercial ones. A name that comes back again and again gives an attacker a stable target to register.
Our own research adds numbers that leaders can act on. We found that only about 1 in 5 AI-recommended dependency versions are safe, and 49% carry known vulnerabilities. The table below consolidates the key figures.
Why this matters for the business
AI-assisted development is now the default way teams ship. The Stack Overflow 2025 survey reports that 84% of developers use or plan to use AI tools, and 51% of professional developers use them daily.
That adoption creates real value. It also widens exposure, because every AI suggestion is a place where a fake or malicious dependency can enter.
The Endor Labs "Malware in Open Source Ecosystems" report found 13.6x more malware advisories since January 2024. In the same research, 81% of organizations call malicious open source a top security priority for 2026.
There is a useful distinction here. Labeling a commit as AI-written answers who wrote it, not whether it is exploitable. What matters for risk is which code and dependencies are reachable and can actually be attacked.
This also affects compliance and customer trust. A malicious dependency that ships to production can trigger breach reporting, audit findings, and lost deals. Those outcomes reach well beyond the engineering team.
For leaders, the goal is to adopt AI coding tools without adding security debt. A clear software supply chain security program lets teams keep their velocity while managing this risk.
How to detect and prevent hallucinated packages
Hallucinated packages are a supply chain problem, so the answer is layered controls rather than a single tool. Treat AI output and its dependencies as untrusted input that must pass the same checks as human-written code.
The four steps below work together: verify before install, review the code, detect malicious packages, and prioritize by what is reachable. Each step is a normal part of a modern development workflow, so none of them require slowing the team down.
Verify dependencies before they're installed
Do not install a package just because the AI suggested it. Confirm that it exists, check its maintainer history and download counts, and pin versions with lockfiles.
The strongest control sits at the install step itself. Endor Labs can block malware before install when an AI agent runs npm or pip install, so a malicious package never reaches a developer's machine.
Review AI-generated code and its imports
AI-written code needs the same scrutiny as human code. Review every pull request for new or unusual dependencies, and separate the person who prompted the AI from the person who approves the change.
Endor Labs adds AI security code review to every pull request, with developer, architect, and security perspectives. You can also secure AI-generated code at the point of generation, before it becomes a pull request.
Prioritize by what's actually reachable
Detection alone creates noise. Reachability tells you which risks are actually exploitable, so teams fix what matters and keep shipping.
This matters because about 95% of vulnerabilities live in transitive dependencies, the packages your packages pull in. Hallucinated or malicious code can hide there.
Endor Labs provides reachability-based prioritization as the security intelligence layer for agentic software development. It builds a call graph across your application and uses full stack reachability to show which findings can actually be reached. That focus cuts up to 95% of the noise.
Frequently Asked Questions
Why do AI models hallucinate packages? AI models predict plausible text instead of checking a live registry, so they produce names that fit common patterns but were never published. Higher randomness settings make it more likely.
Does AI still hallucinate in 2026? Yes, AI models still hallucinate package names in 2026 because the behavior comes from how they generate text. The practical fix is to verify and review what they produce.
How do I prevent hallucinated packages? Verify that a package exists before install, review AI-generated code and its imports, detect malicious packages, and prioritize findings by what is actually reachable.
Next steps: adopt AI coding tools without adding risk
AI coding tools are worth adopting, and the risk from hallucinated packages is manageable with a clear plan. The sequence is straightforward: verify dependencies before install, review AI-generated code and its imports, detect malicious packages, and prioritize by reachability.
Each step keeps developers moving while closing the gap that slopsquatting relies on. Together they let leaders scale AI-assisted development without piling up security debt.
See how Endor Labs handles malicious package detection, AI code review, and full stack reachability across your software. Book a Demo.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
.webp)
