The Attack That Should Not Exist

An AI coding assistant confidently recommends importing a package called react-codeshift. The name sounds right. It follows the naming convention of real packages. The assistant has used it in multiple suggestions. There is only one problem: the package does not exist.

Until someone registers it.

That someone is not the React maintainers. It is an attacker who has been monitoring the open-source ecosystem for hallucinated package names, and they just claimed react-codeshift on npm. Anyone who follows the AI's suggestion will install the attacker's code. Their build will succeed. The dependency will look normal. And the post-install script will have access to API keys, cloud credentials, source control tokens, and model API keys.

This is slopsquatting. The term was coined by Seth Larson, developer-in-residence at the Python Software Foundation, as a portmanteau of "AI slop" and "typosquatting." Typosquatting bets on human error: a developer types reqeusts instead of requests, or numpi instead of numpy. Slopsquatting bets on AI error, and the AI's error is predictable, repeatable, and happens at scale.

The Scale of the Problem

The definitive academic study on this was presented at USENIX Security 2025 by researchers from the University of Texas at San Antonio, the University of Oklahoma, and Virginia Tech. They generated 2.23 million code samples using 16 popular code-generating models across Python and JavaScript.

Of those 2.23 million samples, 440,445 contained at least one hallucinated package name. That is 19.7%. Nearly one in five AI-assisted code suggestions points to a package that does not exist.

Across those hallucinations, the researchers identified 205,474 unique fabricated package names. That is the attack surface. An attacker who systematically registers those names across npm and PyPI has 205,474 opportunities to deliver malicious code to developers who trust their AI assistants.

The hallucination rates vary meaningfully by model class. Open-source models averaged 21.7%. Some CodeLlama configurations exceeded 33%. Commercial models were better but not safe: GPT-4 Turbo, the best performer in the study, hallucinated 3.59% of the time. In a codebase with a hundred dependencies, that is three to four packages that do not exist.

What makes this more dangerous than typosquatting is predictability. The researchers ran identical prompts ten times each and measured how often the same hallucinated name reappeared. Forty-three percent of hallucinated names appeared on every single run. Fifty-eight percent appeared on more than one run. An attacker who identifies which hallucinations a model reliably produces can register those names with high confidence that future developers using the same model and similar prompts will install the malicious package.

How the Hallucinations Look

The USENIX researchers classified hallucinated package names into three categories. Conflations, at 38%, merge two real package names into one. The model knows about jscodeshift and react-codemod, so it invents react-codeshift. Pure fabrications, at 51%, are contextually plausible but entirely invented. They sound like real packages, follow real naming conventions, and would pass a cursory review. Typo variants, at 13%, closely resemble real packages but differ by a character or two.

Conflations are the most dangerous category because they are semantically convincing. A developer reviewing AI-generated code who sees import react-codeshift has no obvious signal that the package is not real. It looks like a legitimate tool in the React ecosystem. The name communicates purpose. The import path follows conventions. There is no typo to catch.

An additional complication: 8.7% of Python packages hallucinated by models actually exist in the npm registry. A developer working in Python could install a JavaScript-ecosystem package by accident, or an attacker could register that exact name on PyPI as a payload delivery mechanism. The cross-registry confusion means that even checking one registry is insufficient.

Confirmed Attacks in the Wild

Slopsquatting stopped being theoretical in early 2026. Several confirmed incidents demonstrate that attackers are actively exploiting this vector.

The unused-imports npm package is one of the clearest documented cases. AI models consistently hallucinate this name instead of the legitimate eslint-plugin-unused-imports. Someone registered unused-imports on npm. As of February 2026, the malicious package was still recording approximately 233 weekly downloads despite having been security-held by npm.

The huggingface-cli package followed a more sophisticated trajectory. Security researcher Bar Lanyado documented that Alibaba had copied an AI-recommended installation command for huggingface-cli into public repository documentation without verification. That documentation signaled legitimacy to thousands of developers who saw the same suggestion, and the package accumulated over 30,000 downloads in three months.

The react-codeshift case demonstrates the agentic amplification problem. Security researcher Charlie Eriksen discovered this conflation-style hallucinated package propagating through 237 repositories via AI-generated agent skills. The downloads were driven not by human developers manually copying code but by autonomous agents executing their own generated outputs. The agent hallucinated the package, generated the install command, and executed it without a human ever seeing the name.

Why Agents Make It Worse

Traditional slopsquatting required a human developer to review AI-generated code, notice a package recommendation, and choose to install it. That provided at least an implicit checkpoint where someone might recognize that react-codeshift is not a real package.

Agentic systems eliminate that checkpoint. As security researcher Andrew Nesbitt observed in April 2026, agents resolve packages programmatically without a human glancing at the name to notice something is off. An agent tasked with building a feature will generate the code, identify its own generated dependencies, and invoke the package manager. No step in that sequence touches a human reviewer.

The credential surface in agentic environments is substantially broader than on an individual developer's machine. Agents often hold API keys, cloud provider credentials, source control tokens, and model API keys in their environment. A malicious package installed by an agent may compromise the entire pipeline, including secrets that provide access to production infrastructure and to the AI model APIs powering the agentic system itself.

The propagation speed is also qualitatively different. In a human-driven workflow, a compromised package takes time to spread. A developer must notice the AI suggestion, install the package, commit it, and have that commit reviewed and merged. In an agentic workflow, a hallucinated dependency can spread across a multi-agent codebase within a single task execution cycle, committed and pushed before any monitoring system triggers.

The Vibe Coding Amplifier

The cultural shift toward "vibe coding" materially worsens the risk. Developers describe desired functionality to AI tools and accept generated implementations with minimal manual review. The practice operates on an implicit assumption that AI-generated implementations are substantially correct. The 19.7% package hallucination rate documented by the USENIX research calls that assumption into serious question for dependency management specifically.

In a vibe coding workflow, a developer says "add a package for code transformation" and the AI suggests react-codeshift. The developer runs npm install. The build succeeds. The import resolves. Nothing looks suspicious. The package was just registered last week by someone the developer will never hear of, but there is no mechanism in the default workflow to surface that information.

The economics are asymmetric. An attacker can monitor public registry activity, identify consistently hallucinated package names at scale, and register them for the cost of an npm account. The defender must verify every AI-generated dependency. That asymmetry favors the attacker and will continue to do so until verification becomes automatic.

What Your Team Should Do

Verify every AI-suggested dependency against the target registry before installation. The package must exist, must have been registered before your project's start date, and must have a publisher with an established track record. A package registered three days ago that your AI suggests for the tenth time is almost certainly a slopsquatting attempt. Commercial tooling from Socket.dev, Snyk, and Aikido can automate this check.

Enforce lockfile pinning and hash verification in CI/CD. Dependencies should be installed from an approved lockfile with known-good hashes, not resolved fresh from the registry on each build. This does not prevent the initial hallucinated package from entering a lockfile, but it prevents attackers from substituting a different payload in subsequent installs.

Implement an allowlist for agentic package installation. AI agents with package management capabilities must operate under an explicit allowlist. Any attempted installation of a package not on the allowlist should route to human review before execution. If an allowlist is not feasible, disable automated package installation in agentic environments entirely until detection capabilities are in place.

Flag packages registered within the last 90 days. Configure software composition analysis tooling to alert on recently registered dependencies. A package that appeared on the registry within the past 30 to 90 days, that your AI assistant suddenly recommends, warrants manual review. Package registration dates are publicly available on npm and PyPI and can be queried programmatically.

Lower the temperature. Industry reporting suggests a correlation between higher temperature settings and higher hallucination rates. Where tooling allows, lowering the temperature for code generation tasks is a low-cost mitigation. It will not eliminate hallucinations. It will reduce their frequency and make the remaining hallucinations more predictable, which helps detection.

Produce SBOMs for AI-generated codebases. A software bill of materials provides traceability when a malicious package is identified and enables rapid impact assessment across the portfolio. SBOM generation should be mandatory in CI/CD for any project with AI-assisted development.

Audit your own documentation for AI-generated install commands. The huggingface-cli incident demonstrates that institutionally trusted documentation can inadvertently propagate hallucinated package names to a wide downstream audience. Scan your documentation for package manager commands against a verified registry to surface risks before they affect users.

The core of the slopsquatting problem is that AI coding tools generate dependencies faster than humans can verify them. The fix is not slower AI. It is automated verification that runs at the same speed as generation. Treat every AI-suggested import as untrusted input. Validate it. Every time.