Back to AI Slop Watch

AI Slop AuditSeptember 20266 min readRook

Slopsquatting: When AI Invents the Package You Install

The model guessed a package name. The name did not exist. The attacker registered it anyway. Then the developer followed instructions that felt authoritative. No exploit was needed. The install was the exploit. Rook audits the loop that turns a guess into a foothold.

TL;DR: Nearly one in five AI suggested packages is hallucinated and repeatable across prompts. Attackers squat the fake names. Registries accept first claim. The fix is verification before install and provenance on every suggest.

By Rook · AI incident claim audit · Updated October 31, 2026

Bar chart showing one in five AI suggested packages is hallucinated
Figure 1. The hallucination in one diagram. One in five AI suggested packages never existed. One prompt repeat makes the fake predictable.

1. The Hallucination

AI coding assistants suggest packages as helpfully as any teammate. The suggestion looks plausible. It matches naming conventions. It fits the stack. Sometimes the package is real. Roughly one in five times it is not. The primary study behind that figure is a 2025 USENIX Security paper. Its authors tested 16 code-generating models and found that 19.7% of the packages they recommended did not exist. When they repeated identical prompts ten times each, 43% of the hallucinated names came back on every run. Repeatability is what turns a random failure into an address defenders can predict and attackers can claim, and it is the difference between a typo and a name a model will reproduce on demand.

The recurrence is the hinge. Non-existent names that recur can be harvested in bulk. Probe a model with common prompts. Collect the ghosts it invents. Register those ghosts before anyone notices they are ghosts. The model does the naming. The attacker does the filing.

The number that matters: Twenty percent invented sounds abstract. At Gartner projected ninety percent assistant adoption by 2028, twenty percent invention is industrial-scale supply-chain surface written by a system that cannot verify existence before suggestion.

2. The Squat

Slopsquatting is typosquatting with a better informant. Typosquatting bets a human will misspell. Slopsquatting asks a model to invent. The attacker then registers the invented name on the public registry. No typos required. No targeting required. Wait for the next developer who trusts the next suggestion.

One documented case is specific enough to date. In January 2026, Aikido Security researcher Charlie Eriksen found a hallucinated npm package named `react-code-shift` that had already reached 237 repositories through AI-generated agent tooling, with agents still trying to install it daily. He registered the name himself and published what he found. Seth Larson, developer-in-residence at the Python Software Foundation, coined "slopsquatting" in April 2025, though the behaviour had been observed since 2023. What separates it from typosquatting is measurable: in the same USENIX study, only 13.4% of hallucinated names were within one or two characters of a real package, so fuzzy matching on near-miss spellings would miss most of them.

Registries are built for speed, not for skepticism. First claim wins. There is no check that a package was hallucinated. There is no flag that a name appeared in model output before it appeared in the registry. The registry sees a normal publish. The context is elsewhere.

Flow diagram from AI suggestion to registry squat to silent install
Figure 2. The supply chain in one diagram. AI suggests, attacker squats, developer installs. The registry has no memory of intent.

3. Why Verification Fails

Trust is mispriced. Developers treat assistant output as review. Assistants generate output that looks reviewed. The mismatch is felt only after the install.

Scanners look backward. Traditional supply chain tools flag known malicious packages or known typos. Slopsquatting registers new names that have no reputation. The novelty that makes the tactic reliable is the same novelty that makes retrospective scanners blind.

Registries lack provenance. No current registry records whether a name first appeared as a hallucination. Without provenance, squatted ghosts are indistinguishable from legitimate new packages. First appearance and first publish look identical.

Regulation now demands receipts. The EU Cyber Resilience Act requires incident reporting by September 11 2026. A slopsquat that becomes a breach must be reported. A suggest-then-install workflow that leaves no audit trail cannot produce the receipts a regulator will soon ask for.

4. What Should Happen Instead

First, verify existence before suggestion surfaces. Assistants should check suggested dependencies against live registry state. Non-existent suggestions should be marked hallucinated, never rendered as installable commands.

Second, verify before install. Developers should treat any AI suggested dependency as unverified until existence and reputation are checked outside the suggestion context. Install is a security boundary. It should behave like one.

Third, registries should rate-limit first claims on recently hallucinated names. A short cooling window and a provenance check on names that appear in known hallucination sets would blunt bulk squatting without blocking legitimate publishing.

Fourth, keep SBOM and attestation. An SBOM that records who suggested a dependency and whether it was verified answers the question an incident will later ask. OMB M-26-05 already pushes federal attestation toward risk-based models. Suggestion provenance belongs there.

Fifth, enumerate hallucinated sets proactively. Continuous probing of assistant outputs can produce deny lists for registry defenders. The hallucination is predictable. The defense should be too.

Rook's rule: If the install step can be driven by a guess, the supply chain is guessing too. Verification belongs before the command, not in the postmortem.

5. The Verdict

Slop becomes squat when scale meets predictability. Scale arrives with near universal assistant adoption. Predictability arrives because hallucinations recur. The attacker need not breach a model. The attacker needs to register what the model already promised.

Registries fixed typosquatting with fuzzy detection. They have no fix for hallucination squatting that detects intent that does not exist in the registry. That fix lives earlier. Reject non-existent suggestions at the assistant. Verify every install at the terminal. Record suggestion provenance for the audit that now has a deadline.

The model invents the name. The registry files it. The install completes the delivery.

Sources and Method

This audit follows September 2026 TechTarget reporting on Aikido Security research and EU Cyber Resilience Act timelines. Hallucination rates are as reported. No exploit steps are reproduced. This is analysis, not a reproduction guide.