Slopsquatting: the scam built on packages AI invents

You ask an AI assistant for a code example, it answers with a confident pip install, you copy, paste and run. The catch: that package never existed — until a criminal noticed the AI keeps suggesting that name and registered it in the official repository with malware inside. This is slopsquatting, one of the smartest evolutions of the supply chain attack, and it was born directly out of a known defect in language models: hallucination.

What is slopsquatting?

Slopsquatting is the malicious registration of package names that AI assistants invent while generating code. The attacker works out which non-existent names models hallucinate most often, publishes packages under those names on npm, PyPI or similar, and waits for developers to install the suggestion without checking. The name is a joke on "slop" — the nickname for low-quality AI-generated content — bolted onto good old typosquatting.

What sets it apart from classic typosquatting is the source of the error. In the swapped-letter scam, the attacker bets on your finger slipping on the keyboard. In slopsquatting, they bet on the AI making the mistake for you — with one advantage: researchers have shown that models hallucinate the same package names consistently. If the AI invents requests-oauth-helper today, it tends to invent it again tomorrow, for another developer. The hallucinated name becomes a predictable meeting point between victim and attacker.

And the problem has been measured: a 2025 academic study testing 16 code-generation models found non-existent packages in roughly 20% of samples — hundreds of thousands of hallucinated names in total — and close to half of those names recurred consistently when the same prompt was run again. In other words: this isn't a rare, random stumble by the model, it's a pattern predictable enough to become a criminal business model.

Why it works so well

• Transferred trust: whoever trusts the AI's answer transfers that trust to the install command that came with it. Few developers check the official repository to see whether the package exists, who maintains it and since when.
• Plausible names: hallucination doesn't produce absurd names — it produces names that look like the ecosystem's conventions (flask-json-utils, aws-s3-tools). The plausibility is the disguise.
• Installing already means executing: both npm and pip allow install scripts. You don't even need to import the library — the install alone runs the attacker's code on your machine, with access to environment variables, tokens and SSH keys.
• Scale: the same popular prompt ("how do I upload to S3 in Python") produces the same hallucinated suggestion for thousands of people. A single registered package catches the whole queue.

The mechanism echoes what we've seen in real attacks on the JavaScript ecosystem, such as the Miasma case on npm: the official repository is the perfect distribution channel because nobody suspects the channel — except that here the bait is custom-built out of the AI's statistical errors.

How to protect yourself (dev and company)

In the developer's day to day

• Check before installing: open the package page on npm/PyPI and look at three things — publication date, download count and linked repository. A freshly created package with few downloads and no public repository is a triple red flag.
• Be suspicious of the exact suggestion: if the AI suggested a library you've never heard of, search the name before the install. Five seconds of searching dismantles most cases.
• Pin versions and use a lockfile: package-lock.json and requirements.txt with fixed versions stop a new dependency from entering the project without review.
• Extra care with batch-generated code: the more code the AI generates at once, the smaller the chance you review every import — which is exactly the scenario where the fake package gets through.

In the company pipeline

• Internal registry or proxy with an allow list — the hallucinated package dies at the door if only approved dependencies get into the build.
• Dependency scanning in CI with alerts for packages that are new to the project, especially recently published ones.
• A clear policy for AI-written code: the same precautions for using ChatGPT at work apply to the code it hands back — human review of dependencies isn't optional.

The link to the other attacks on AI users

Slopsquatting completes a pattern we've covered before: AI as an attack surface, not just as a tool. Prompt injection manipulates what the model does; data poisoning corrupts what it learns; slopsquatting weaponizes what it gets wrong. In every case the defense is essentially the same — treat AI output as a draft to be verified, never as a final authority.

Model hallucination isn't a new problem, and it won't disappear in the next release. What changes is the cost of ignoring it: it used to be a broken import in your terminal; now it can be a credential stealer running with your permissions. Check the package, then install — in that order.