Slopsquatting: When AI Agents Hallucinate Malicious Packages

AI coding agents can invent package names that do not exist. Attackers register those names and fill them with malware. Here's how AI hallucinations are compromising your codebase, and what to do about it.

What is slopsquatting?

Slopsquatting is a software supply chain attack that turns AI hallucinations into malware delivery. An AI coding agent suggests a package that does not exist, an attacker registers that name and loads it with malicious code, and the agent can install it before a developer even realizes it.

The name borrows from typosquatting, but the mechanism is different. Typosquatting preys on human error: a developer fat-fingers lodahs instead of lodash and lands on a malicious lookalike. Slopsquatting preys on a model error.

The hallucinated name is not a misspelling of a real package. It is a plausible-sounding invention the LLM produced from scratch. That distinction matters for defense, because spell-check and name-similarity heuristics do not catch a package name that no human mistyped.

The targets are developers who lean on AI coding agents like Cursor, GitHub Copilot, and Claude Code to write and wire up code. For the wider category of AI-introduced risk, see our hub on the most common security vulnerabilities in AI-generated code.

Why AI coding assistants hallucinate package names

Large language models predict plausible text, not verified facts. When a model suggests a dependency, it generates a name that fits the statistical shape of real package names, with no check that the package exists. Three patterns drive the hallucinations.

First, models blend fragments of real packages into new, nonexistent ones. Second, they confuse names across ecosystems, suggesting an npm-style name for a Python project or the reverse. Third, they fill gaps with confidence, naming a library for a niche task even when no such library exists.

Research on package hallucination has measured how often this happens, and the findings are the reason slopsquatting works. Studies have found that models invent nonexistent package names in a meaningful share of coding prompts, that the same hallucinated names recur across repeated prompts, and that the invented names look plausible enough to pass a quick glance.

The behavior persists across model families and newer releases. The recurrence is the dangerous part: a name the model invents once, it tends to invent again, which gives an attacker a stable target to pre-register.

How attackers weaponize hallucinated dependencies

The attack chain is short. Attackers run coding prompts at scale or watch AI outputs to catalog the package names models hallucinate most. They register those names on public registries like npm and PyPI and attach post-install scripts that read environment variables and exfiltrate tokens, cloud keys, and Git credentials the moment the package installs. Once a developer adds the package, it lands in the lockfile and persists, shipping through CI/CD to every environment that builds the project.

Vibe coding and agentic IDEs sharpen the risk. As developers let AI write code with little review, and as agentic tools auto-install dependencies without a human in the loop, the gap between a hallucinated suggestion and a running install closes. Tool-use and MCP integrations let agents resolve and install packages on their own, and chained agent commands can pull in a malicious dependency before anyone reads the name. The same automation that speeds development removes the review step that would have caught the fake.

A worked example

Here is how a slopsquatting attack would unfold in practice.

1. A developer asks an AI assistant for a library to parse a niche file format.
2. The assistant suggests fastparse-xyz, a name that sounds right but points to nothing in the registry.
3. An attacker, having seen this same hallucination recur across prompts, has already registered fastparse-xyz and added a post-install script.
4. The developer runs the install. The script reads environment variables and exfiltrates the project's cloud and Git credentials.
5. The dependency settles into the lockfile and rides CI/CD into production, reaching every environment that builds the project.

No step in that chain requires the developer to make a mistake. They asked a reasonable question and trusted a confident answer. Security researchers have observed hallucinated names recurring across repeated prompts, which is exactly what makes step three viable.

How to protect your pipeline

Slopsquatting defeats a casual review and slips past tools that only match known-bad names, so defense needs layered controls plus developer awareness. Traditional SCA on its own is not enough.

• Verify package provenance before installation. Check the package age, download counts, and maintainer history. Confirm the name against official documentation or the project's real repository. Use package signing where it exists.
• Block malicious packages using a dependency firewall. Real-time scanning for newly uploaded malicious packages gets you in front of attacks, and then a package firewall blocks them before a malicious slopsquat lands on a developer's laptop.
• Scan your full dependency tree with SCA and reachability. Deploy malicious package detection across direct and transitive dependencies, and layer reachability analysis to prioritize the findings that an attacker can actually reach.
• Sandbox AI-generated package installs. Run AI suggestions in isolated environments first, use container sandboxes for testing, and add dry-run modes to CI so a new dependency proves itself before it ships.
• Enforce policy across AI coding agents. Point agents at private registries, maintain allowlists of approved packages, and require human approval for any new dependency an agent wants to add.

FAQ

What is slopsquatting? Slopsquatting is a software supply chain attack that exploits AI hallucinations. An AI coding assistant suggests a package name that does not exist, an attacker registers that exact name and fills it with malware, and any developer who follows the suggestion installs the malicious package.

How is slopsquatting different from typosquatting? Typosquatting targets human typos by registering names a character off from popular packages, such as lodahs for lodash. Slopsquatting targets machine fabrication by registering the plausible-sounding names that AI models invent. The hallucinated name is not a misspelling of any real package, so name-similarity checks do not catch it.

Is slopsquatting happening now, or is it theoretical? It is not theoretical.

Research has shown that AI models hallucinate package names at measurable rates, that the same names recur, and that the names look legitimate. Those three properties are all an attacker needs to pre-register hallucinated names and wait for installs. Treat it like any other live supply chain threat.

Which AI tools are affected? Any AI coding assistant that suggests dependencies can hallucinate package names, including Cursor, GitHub Copilot, Claude, and others. The risk grows with agentic IDEs that auto-install dependencies, because they can act on a hallucinated suggestion before a human reviews it.

How do you prevent slopsquatting? Verify package provenance before installing, scan the full dependency tree with malicious package detection and reachability analysis, sandbox AI-generated installs, and enforce policy across AI agents with private registries, allowlists, and human approval for new dependencies.

Slopsquatting is already happening, and AI adoption keeps widening the opening. Audit how your teams use AI assistants, put controls in place, and route AI-suggested dependencies through the same scanning as everything else. See how Endor Labs detects and blocks malicious packages before they reach production, or book a demo.