Slopsquatting: 1 in 5 AI Code Samples Recommends a Package That Doesn't Exist

Typosquatting needed you to make a mistake. Slopsquatting doesn't need you at all. The model makes the mistake, and the attacker just registers the result.

The name comes from Seth Larson at the Python Software Foundation: typosquatting, minus the typo, plus the slop.

If you use an AI coding assistant, you've seen this. It invents a package. Something plausible: strutils-pro, or a very official-sounding secure-random. The install fails, you shrug, you move on.

That failed install is the good outcome. The bad one installs cleanly, because someone else got to the name first.

One In Five, Measured

The largest measurement we have comes from researchers at UT San Antonio, the University of Oklahoma, and Virginia Tech, presented at USENIX Security 2025. They generated 2.23 million code samples with 16 code-generating models, Python and JavaScript, and checked every import against the real PyPI and npm registries.

19.7% of the samples contained at least one package that does not exist.

Not deprecated APIs. Not broken code. Fabricated import statements, delivered with full confidence.

That's 440,445 samples carrying 205,474 unique invented names. The spread matters as much as the total: open-weight models hallucinated packages at 21.7% on average, commercial models at 5.2%. CodeLlama-family models crossed 33% in some configurations. The best performer, GPT-4 Turbo, still sat at 3.59%.

Pick your favorite model. At the volume your team generates code, even the best rate is a weekly event.

The 2026 Check: Quieter, Not Fixed

In May 2026, an independent researcher re-ran the same methodology against five frontier models released between October 2025 and March 2026, across 199,845 prompts validated against the full PyPI and npm package lists.

Hallucination rates landed between 4.62% and 6.10%. The gap between best and worst collapsed from roughly tenfold to nearly nothing. On the surface, that reads as progress.

Then there's this: 127 package names that all five models invent identically.

Not similar names. The same names, from models built by different companies on different training runs. After coordinated disclosure to PyPI Security, 53 of them were still registrable by anyone with an account and a few minutes.

Five independent models agreeing on the same fiction means an attacker doesn't need to predict one model's quirks. Register the shared hallucination once, and every assistant in the ecosystem points its users at it.

Someone Ran the Attack for $496

In 2026, a research team did the thing everyone assumed someone would eventually do. They extracted 107 hallucinated package names from eight prominent LLMs, uploaded them to npm, and watched for six months.

The entire campaign cost an estimated $496.

35.2% of the installs came from real developers, with most first interactions landing within two weeks of registration. And 25.2% of the invented names sat within one character of a real package, close enough to survive a casual glance even when somebody checks.

One more finding worth sitting with: adding web search to the generator made it worse. Hallucination persistence rose from 11.2% to 17.3%, because the search results were themselves contaminated with AI-generated content. The tool we add to reduce hallucinations can quietly launder them.

Why Agents Move This From Nuisance to Attack Path

A human who types pip install usually glances at the name. Usually. An agent doesn't glance. It resolves dependencies as part of the task, installs them, and reports success.

The failure mode moves from "annoying error I noticed" to "dependency I never saw."

The Cloud Security Alliance stopped hedging in April 2026: treat every AI-recommended dependency as untrusted input. Not a suggestion. Not a shortcut. Input from a source that is confidently wrong several percent of the time, and real attackers have already started registering names to catch it.

Four Checks That Close the Door

None of the defenses are exotic. The CSA guidance collapses into four checks:

1. Verify before install. Does the package exist on the registry? Was it registered before your project started? Does the publisher have a history, or was the name claimed last month?

2. Treat lockfiles as load-bearing. Commit them, verify hashes on install, and build from the approved lockfile, not from the agent's enthusiasm.

3. Agents get an allowlist. If your coding agent can install packages, it installs from a list a human approved. Everything else escalates.

4. Generate an SBOM. If a large share of your code and dependencies arrived by generation, you need a manifest that says what's actually in the build.

The first check is small enough to run in CI:

# the model suggests; the registry decides
import sys
import requests

REGISTRY = "https://pypi.org/pypi"

def exists(name: str) -> bool:
    return requests.get(f"{REGISTRY}/{name}/json", timeout=10).status_code == 200

suggested = ["requests", "fastapi", "pydantic", "strutils-pro"]  # from the agent
for pkg in suggested:
    if not exists(pkg):
        sys.exit(f"blocked: '{pkg}' is not on PyPI, a human looks at this one")

💡 Pro-tip: a hallucinated package that fails to install is the system working. The dangerous one is the hallucination that succeeds, because it stopped being a hallucination the moment someone registered it.

The Part I Can't Shake

I keep coming back to the 127 shared names more than the 19.7%.

The rate tells you how often a model slips. The shared names tell you the slips aren't random. Different companies, different training data, converging on the same invented package. That is a property of the ecosystem, not of any one vendor. Switching models doesn't fix it. Blaming your vendor definitely doesn't.

For twenty years, supply-chain attacks needed a human to typo, click, or skip a check. Now the typo happens inside the model, at machine speed, several percent of the time, and the click is optional.

Have you caught your assistant suggesting a package that didn't exist? Did you verify it, or did the failed install do the verifying for you?

References

1. Churilov, The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort (2026): arxiv.org/abs/2605.17062
2. Huang et al., Package Hallucinations as Phantoms in Open-source Software Supply Chains, ACM TOSEM (2026): dl.acm.org/doi/abs/10.1145/3830237
3. Cloud Security Alliance, Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks (April 2026): labs.cloudsecurityalliance.org. The CSA note documents the USENIX Security 2025 measurement used above, plus the full mitigation guidance.