AI Package Hallucination — Slopsquatting
Coding assistants sometimes recommend packages that don't exist — and they recommend the same invented name again and again. If an attacker registers that name first, every developer who trusts the assistant installs the attacker's code.
What is slopsquatting?
Coding assistants sometimes recommend packages that do not exist. The names look plausible, and the same invented names tend to come up repeatedly.
Slopsquatting is registering one of those names on a public registry and putting harmful code in it. The next developer who follows the assistant's advice installs the attacker's package.
A real case
A USENIX Security 2025 study tested 16 code-generation models across 576,000 samples. About one in five recommended packages did not exist, the researchers counted more than 205,000 distinct invented names, and many were repeated across runs, which is what makes them worth registering for an attacker.
The repeat rate is the point of this lab: a name the assistant invents again and again is a name worth registering.
Source: USENIX Security 2025
How to fix it
- Check that a suggested package exists, has a history and is the one you intended before installing.
- Use lockfiles and an internal registry or allow-list.
- Run dependency scanning that flags new and low-reputation packages.
- Do not let coding agents install packages without review.
Questions people ask
What is package hallucination?
A model inventing a library name that sounds real. It is a wrong answer that happens to be something an attacker can register.
Why is it called slopsquatting?
By analogy with typosquatting, where attackers register misspelled package names. Here they register names produced by AI.
How common is it?
A study presented at USENIX Security 2025 found roughly one in five packages recommended by the models it tested did not exist.
Read the full OWASP LLM Top 10 guide · All free labs · AI red team certification