Incident Overview
In early 2025, researchers demonstrated a novel attack vector targeting developers using AI-powered coding assistants. The vulnerability stems from a phenomenon termed slopsquatting, where AI tools like ChatGPT suggest non-existent package names during code generation. Attackers exploit this by registering these fabricated package names in repositories such as PyPI (Python) and npm (JavaScript), enabling them to distribute malicious code to unsuspecting developers who trust the AI’s recommendations. This creates a supply chain compromise, as developers unknowingly integrate compromised packages into their projects.
The issue was formally recognized in 2025 after registries like PyPI and npm introduced monitoring systems to detect and mitigate such threats. Slopsquatting represents a supply chain risk uniquely enabled by AI hallucinations—the generation of factually incorrect but plausible package names. Unlike traditional typosquatting, where attackers register misspelled versions of legitimate packages, slopsquatting relies entirely on the AI’s erroneous suggestions, making it harder to predict or prevent without proactive measures.
Researchers from Vulcan Cyber and academic institutions conducted experiments to quantify the scale of the problem. They found that AI coding assistants frequently recommend non-existent packages, with commercial models like ChatGPT exhibiting at least a 5.2% hallucination rate and open-source alternatives reaching as high as 21.7%. This translates to 205,474 unique hallucinated package names across tested models, highlighting the systemic nature of the threat.
The attack flow begins when a developer consults an AI assistant for a code-related task. If the package does not exist, attackers can register it beforehand, replacing the legitimate functionality with malicious code.
The harm extends beyond individual developers to entire ecosystems. Malicious packages registered under hallucinated names can propagate through open-source repositories, affecting downstream projects that depend on the compromised libraries. The supply chain nature of the attack amplifies its impact, as trust in package repositories is undermined by the AI’s unreliable suggestions.
Registries responded by implementing automated monitoring to flag suspicious package registrations, particularly those that align with known hallucination patterns from AI tools. However, the root cause—the AI’s tendency to generate plausible but incorrect package names—remains unresolved without broader industry adoption of mitigation strategies. The term slopsquatting was coined to distinguish this attack from traditional typosquatting, emphasizing its dependence on AI-generated errors rather than deliberate misspellings.
Possible Root Cause
The primary root cause of slopsquatting is the hallucination behavior exhibited by large language models (LLMs) trained on code generation tasks. Hallucinations occur when an LLM produces outputs that are factually incorrect but syntactically or contextually plausible. In the context of package recommendations, this manifests as the suggestion of package names that do not correspond to any existing or legitimate library in repositories like PyPI or npm.
For instance, an LLM might conflate similar-sounding package names or invent names that resemble real ones but do not exist.
Second, the prompt engineering techniques used to interact with AI coding assistants can influence the likelihood of hallucinations. Certain prompts may inadvertently encourage the model to generate creative or speculative solutions, including non-existent packages.
Third, the lack of integration between AI tools and package registries exacerbates the problem. They do not cross-reference their suggestions against live package databases, leaving them vulnerable to generating hallucinated names. This disconnect is particularly problematic in dynamic ecosystems like PyPI and npm, where packages are frequently added, removed, or renamed.
Commercial models like ChatGPT, fine-tuned on curated datasets, exhibit lower error rates (around 5.2%) compared to open-source models, which can reach 21.7% due to less rigorous training processes. However, even commercial models are not immune, as their hallucinations can still be exploited by attackers registering fabricated names.
Takeaways
The slopsquatting incident underscores the need for proactive validation mechanisms in AI-powered development tools. Developers and organizations should treat AI-generated package recommendations as untrusted inputs, verifying their existence independently before installation.
Package registries must enhance their monitoring capabilities to detect and mitigate slopsquatting attempts. However, broader adoption of package name reservation systems—where frequently suggested or high-risk names are temporarily reserved—could further reduce the attack surface.
AI developers should prioritize hallucination mitigation strategies in their models. The study referenced in this incident demonstrates that techniques such as post-generation validation, confidence scoring, and adversarial training can significantly reduce the frequency of incorrect package suggestions.
Organizations adopting AI coding assistants should establish governance policies to address supply chain risks.
The broader cybersecurity community must recognize slopsquatting as a systemic risk enabled by the intersection of AI and software supply chains. While traditional attacks like typosquatting rely on human error or deliberate misspellings, slopsquatting exploits the inherent limitations of AI models. This shift requires a reevaluation of security practices, from developer training to registry policies, to account for the unique challenges posed by AI-generated content.
Finally, the research community should continue investigating adversarial machine learning techniques to harden AI models against manipulation. Collaboration between AI researchers, cybersecurity experts, and package registry operators will be essential to developing sustainable solutions. The long-term goal should be to reduce the reliance on unvalidated AI suggestions in critical development workflows, ensuring that software supply chains remain resilient against emerging threats.