Slopsquatting: when AI coding assistants invent package names attackers are waiting to claim

Typosquatting exploits a human's fingers. Slopsquatting exploits their trust in the machine that types for them.

The attack is simple. A language model hallucinates a plausible-sounding package name that has never existed. An attacker registers that exact name on npm or PyPI. The next developer, or the next autonomous coding agent, who copies the install command from the AI's suggestion pulls the attacker's code straight into the build. The registry sees a perfectly real package. There is nothing to flag.

How it differs from typosquatting#

Traditional typosquatting depends on visual similarity to a real package. lodash becomes 1odash. An attacker substitutes a character and hopes a developer makes a spelling error. Because npm and PyPI know their existing package names, they can run similarity checks and reject names that look too close to established packages.

Slopsquatting bypasses this entirely. Hallucinated names are brand new strings. There is no existing package to be similar to. The name react-codeshift, for example, does not resemble any single real package closely enough to trigger a collision check. It is, however, exactly what a language model produces when it conflates two real tools: jscodeshift and react-codemod. The hallucination feels authoritative and completely plausible. The registry has no mechanism to distinguish it from any other new package being published for the first time.

The numbers behind the risk#

The foundational research appeared at USENIX Security 2025. Researchers tested sixteen code-generating language models across a corpus of programming questions and found average package-hallucination rates of approximately 5.2% for commercial models and 21.7% for open-source models. Even the best-performing model in the study, GPT-4 Turbo, hallucinated packages at a 3.59% rate.

A 2026 study by independent researcher Aleksandr Churilov retested five major frontier models against the same prompt corpus: Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2. He found 127 hallucinated package names shared across all five models. As of April 2026, 53 of those names, 41 on PyPI and 12 on npm, were still available for registration. An attacker who registers any one of them gets a package that five major AI models will recommend to users of all five platforms simultaneously.

The predictability is what makes this structurally dangerous. When researchers re-ran identical prompts ten times each, 43% of hallucinated package names appeared on every single run. An attacker does not need to guess. They run a few dozen prompts, identify the names that recur consistently, and register them. The hallucination is not random noise. It is a reproducible fingerprint.

The react-codeshift case#

In January 2026, Aikido Security researcher Charlie Eriksen noticed something unusual. A hallucinated npm package name had spread to 237 GitHub repositories through AI-generated agent skill files before any attacker had claimed it. The name was react-codeshift. It does not exist, has no legitimate author, and had never been published. A language model had invented it by conflating two real packages: jscodeshift, the JavaScript codemod tool, and react-codemod, the React migration utility.

Eriksen registered the name defensively before an attacker could. Immediately after registration, download attempts from autonomous agents began arriving. The agents had been told to install react-codeshift and were following instructions.

What makes this case instructive is that nobody planted the hallucination. No attacker seeded the AI with a fake recommendation. The model generated the name independently, it spread organically through AI-assisted code generation, and the attack surface existed purely because of what the model believed was true.

The cross-registry dimension#

An additional layer of risk compounds the problem. Researchers found that 8.7% of Python packages hallucinated by models are actually valid JavaScript packages. A developer working in Python who copies an AI-suggested install command could unknowingly attempt to install a name that exists only in npm, or that an attacker has registered in PyPI to intercept exactly this kind of cross-registry confusion.

The traditional package ecosystem assumption, that a name is either real in your ecosystem or it is not, breaks down when the source of the install command is a model that learned from code across all ecosystems simultaneously.

What changed in 2026#

Slopsquatting was a theoretical risk when the USENIX paper was published. It is not theoretical anymore.

Amazon's July 30, 2026 attribution report connecting the debug, chalk, and axios npm attacks to North Korea's Sapphire Sleet specifically identified slopsquatting as an emerging tactic in the attacker's evolving playbook. The same report documented Sapphire Sleet registering package names that AI coding assistants predictably hallucinate, positioning the malicious packages to be installed when developers or autonomous agents follow AI-generated instructions. Attestd covered all four packages in that campaign: debug, chalk, axios, and typo-crypto all return risk_state: critical with supply_chain.compromised: true.

On August 8, 2026, OpenSourceMalware documented the WEL1DROPPER campaign: a Russian threat actor publishing over 700 malicious packages to npm within 48 hours, all using AI-hallucinated package names, with none requiring install lifecycle hooks. A single require() call triggers infection. The campaign crossed 1,000 packages within days.

Nation-state actors are actively using slopsquatting in production attacks today.

How Attestd detects it#

Attestd's supply chain layer includes a dedicated typosquat signal with a hallucination classification. When a package name closely resembles a name that AI models consistently hallucinate without a corresponding legitimate package in that ecosystem, the response includes a typosquat field with kind: hallucination alongside the standard supply chain fields.

A live example from the Alibaba dependency confusion coverage published earlier this month: local-config-parser, a package in that campaign's cluster, returned:

"typosquat": {
    "detected": true,
    "kind": "hallucination",
    "resembles": "config-parser",
    "likely_intended": ["config-parser"],
    "confidence": 0.9,
    "ecosystem": "pypi"
}

The supply_chain.compromised flag and the typosquat.kind: hallucination flag are independent signals. A package can be compromised without being a hallucination target. A package can be a hallucination target without yet being compromised. Both signals matter, and they fire on different conditions.

The hallucination detection does not require the package to be malicious to return detected: true. It fires when the name pattern matches the profile of names models consistently invent, regardless of whether an attacker has claimed it yet. That is the signal most useful for autonomous pipelines that need to gate on both conditions.

The autonomous agent amplification#

Slopsquatting is a supply chain attack that scales with AI adoption. A human developer copying an AI suggestion and noticing something seems off before running the install command is one kind of exposure. An autonomous coding agent that receives a task, generates install commands, and executes them without a human reviewing the package list is a categorically different exposure profile.

The HalluSquatting research published by Tel Aviv University, Technion, and Intuit on July 8, 2026 tested six major coding tools including Cursor, Windsurf, GitHub Copilot, and Gemini CLI. Models hallucinated identical names up to 85% of the time for repository requests and 100% of the time for skill installs. When the consumer of the hallucinated recommendation is an agent that executes without a review step, the attack surface is not a subset of developer machines. It is every agent deployment that touches package installation.

This is the specific reason the Attestd typosquat signal includes hallucination detection as a first-class field rather than a note in the documentation. An autonomous system needs to be able to check whether a package name it is about to install matches a predictable hallucination pattern before the install runs. The check takes one API call. The alternative is trusting that the name the model generated is real.

The defense#

The registry cannot protect you from slopsquatting the way it can protect you from typosquatting. There is no similarity check to run against a name that has never existed before. The defense has to happen before the install, not at the registry level.

Practical steps that reduce exposure:

Check package names before installing them. If an AI assistant recommends a package you have not used before, verify it exists on the registry before running the install command. The react-codeshift case is instructive: a quick npm info react-codeshift before installing would have returned a 404 before the package was defensively claimed.

Use a supply chain check in your pipeline. For autonomous systems or CI/CD pipelines that run installs without human review, a pre-install check against a supply chain API that includes hallucination detection prevents a hallucinated name from reaching the install step. If you are using Attestd in Claude Code, Cursor, or Windsurf, the for-developers page covers the MCP setup that brings this check directly into your IDE.

Pin dependencies explicitly. An autonomous agent that installs from a lockfile rather than resolving package names fresh at install time is not vulnerable to a newly registered slopsquat name.

Be skeptical of AI-generated package names for small utilities. The hallucination pattern is strongest for niche utility packages where no single canonical name dominates. An AI assistant recommending lodash is almost certainly correct. An AI assistant recommending a utility you have never heard of in a namespace you do not recognize is the higher-risk recommendation.

Further reading#

The Sapphire Sleet attribution report that explicitly names slopsquatting: attestd.io/blog/sapphire-sleet-debug-chalk-axios-npm-attribution

How Attestd detects compromised packages and hallucinated names: attestd.io/docs/supply-chain

The typosquat field in the API response: attestd.io/docs/api-reference

The machine speed thesis: attestd.io/thesis