AI models frequently hallucinate package names that do not exist in public registries, creating opportunities for supply-chain attacks known as slopsquatting. A researcher examined 139 names that five recent AI models consistently invented and checked their status on PyPI and npm as of 22 September. Seven names were already registered, with one previously hosting malicious code.
The attack works when developers copy installation commands such as pip install or npm install directly from AI responses without verification. If the name is available, an attacker can register it and include arbitrary code that runs with the developer’s privileges, exposing keys, tokens, and environment variables. This mirrors typosquatting but relies on consistent model errors rather than human typos.
Among the registered names, metro-evaluator on npm contained malicious code published in four versions on 7 December 2025 and removed five days later. npm replaced it with a security-hold placeholder. The package had been suggested by the tested models a total of ten times. Another name, css-color-stop, was registered after the list became public and contains only a 53-byte package.json file with no executable code.
Four other occupied names belong to legitimate but unrelated projects: odf, lusid, usr, and ssh-keys. The odf package on PyPI receives nearly 5,000 downloads per month and is unrelated to the OpenDocument library developers likely intended. The real weaviate client is published under weaviate-client, while the brand owner maintains an empty placeholder under the hallucinated name.
Earlier research cited in the report found hallucination rates of 19.7% across 16 models and 576,000 code snippets. Commercial models averaged 5.2% while open-source models reached 21.7%. A separate study of five newer models reported rates between 4.62% and 6.10%. One documented case showed the empty huggingface-cli package on PyPI accumulating over 30,000 downloads after an incorrect command appeared in an Alibaba repository.
AI coding agents increase the risk because they can execute installation commands autonomously. In one campaign, the name react-codeshift appeared in 47 generated files and spread to more than 237 repositories. Researchers demonstrated prompt-injection techniques that tricked agents into requesting attacker-controlled package names with success rates up to 100% on tools including Cursor, Windsurf, and GitHub Copilot.
Registry operators already block many hallucinated names through normalization and prohibition lists, leaving approximately 53 names still available for registration. The study emphasizes that developers and team leads should require human approval before AI agents install dependencies and should inspect package metadata with commands such as npm view or PyPI JSON endpoints before installation.
