Slopsquatting: when AI recommends packages that don't exist

You ask an AI coding tool to add a feature. It tells you to install some library, you copy the command, you run it. Except that library doesn’t exist. Or worse: it does exist, because an attacker saw the same suggestion before you did and registered that exact name on purpose. This has a name, a scientific study behind it, and a simple way to protect yourself.

Where the problem comes from: a precise scientific study

In 2025, six researchers (Joseph Spracklen, Raveen Wijewickrama, A H M Nazmus Sakib, Anindya Maiti, Bimal Viswanath, and Murtuza Jadliwala) published a study on this at the 34th USENIX Security Symposium, one of the reference conferences in computer security, titled “We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs.”

Their method: generate 576,000 code samples with 16 different AI models (both commercial and open-source), in Python and JavaScript, then check whether every package mentioned actually exists in the official registries (npm, PyPI). The result: 19.7% of recommended packages didn’t exist. That rate climbs to 21.7% for open-source models, versus 5.2% for commercial ones. In total, the researchers counted 205,474 distinct package names, all invented.

The most important detail for understanding what comes next: these invented names aren’t random each time. The same model, asked again with a similar prompt, tends to reinvent the same fictional name. That’s exactly what makes the attack possible.

How an attacker exploits this: slopsquatting

Seth Larson, developer-in-residence at the Python Software Foundation, gave this attack technique a name in April 2025: “slopsquatting,” a blend of “AI slop” (low-quality AI-generated output) and “typosquatting” (registering a name close to a known one to catch a typo).

The mechanism is direct: an attacker queries the same AI models everyone else uses and notices which fictional package names come up repeatedly. They then register that name for real, on npm or PyPI, with malicious code inside. All that’s left is to wait for a developer (or an autonomous AI agent running commands without supervision) to type npm install invented-name or pip install invented-name, blindly following the suggestion. The flaw isn’t in an existing package anymore; it’s in the trust placed in a name that never existed before the attacker created it.

The OWASP Top 10:2025, the world’s reference list of web security risks, created a dedicated category for exactly this kind of risk in 2025: “Software Supply Chain Failures,” which expands the old category for vulnerable components. Where your dependencies come from and how they’re distributed is now recognized as a risk in its own right, not just a technical footnote.

Why this hits vibe coding especially hard

When you don’t code day-to-day yourself, you don’t necessarily have the reflex to check that a package actually exists before installing it: the AI tells you to, so you do it. That’s exactly the terrain where slopsquatting works best. Researchers found that a hallucinated package name can reappear across different models and different queries, which means the same fake name can circulate widely before an attacker even exploits it.

What if the AI itself types the command?

The most recent vibe-coding tools (Claude Code, Replit Agent, and similar agents) don’t just suggest a command anymore: they can run it themselves, with no human reading it before it fires. That’s exactly what makes slopsquatting more dangerous in this setting: installing dependencies declared in a lockfile or manifest is, by nature, treated as a routine action by these tools, not as a risky one that automatically triggers a second look. A hallucinated name no longer even needs to convince a human to type npm install; it only needs to convince the AI to suggest it once, and it ends up running.

That doesn’t mean you should avoid these tools, but it does mean the manual checks described below matter even more once you hand them the keyboard: review the list of packages an AI is about to install before approving it, exactly the way you’d review a code change.

How to check a package before installing it

Before running npm install or pip install on a name an AI just suggested, take thirty seconds for these checks:

1. Confirm the package actually exists, on the registry’s official site (npmjs.com or pypi.org), not just in the terminal. You can also pull up its details from the command line without installing it yet:

npm view package-name

2. Look at its history. According to OWASP’s npm security guide, a trustworthy package usually has “thousands, or even millions of downloads” and “a real GitHub repository, with genuine code, commits, and contributors.” A package published yesterday, with zero downloads and no repository, should raise a flag, especially if an AI just suggested it to you.
3. Run a security audit on what you’ve already installed:

npm audit

Per npm’s official documentation, this command “submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities.”

4. Keep a lockfile (package-lock.json or equivalent) and avoid installing a version that isn’t in it yet without checking it first.
5. Double-check the exact spelling. A name that’s almost right, one letter swapped or a hyphen moved, is a classic sign of a package that’s impersonating a popular one, whether or not an AI was involved in suggesting it.
6. To go further, automated tools exist to flag recently published or suspicious packages before they enter your project, as a complement to your own vigilance.

None of this takes long once it’s a habit. The point isn’t to distrust every suggestion an AI coding tool makes; it’s to treat a package name the same way you’d treat a link in an email you weren’t expecting: worth a second look before you click, or in this case, before you install.

Key takeaways

• A USENIX Security 2025 study, covering 576,000 code samples and 16 AI models, measured that 19.7% of packages recommended by these AIs didn’t exist.
• Slopsquatting (a term coined by Seth Larson in April 2025) is when an attacker registers these invented names before a developer installs them by mistake.
• This risk now has its own category in the OWASP Top 10:2025, dedicated to the software supply chain.
• Before installing a package an AI suggested: check that it exists on the official registry, look at its download history and repository, then run a security audit.
• Never trust a package name just because an AI gave it to you.

To automate this check on every install, the verif-paquets connector runs this lookup for you before you type the command.