Package hallucination

Slopsquatting: When AI Hallucinations Become Supply Chain Attacks

AI coding assistants hallucinate package names 19.7% of the time. Attackers register those names on npm and PyPI before real packages can claim them. Tens of thousands of developers have already installed malicious packages their AI suggested. Here is how the attack works, what the research shows, and how to stop your team from becoming the next victim.

HOLJul 21, 2026