← All incidents

Slopsquatting: AI coding models invented 205,474 unique package names in one study

Research · All LLM coding tools · MEDIUM

Summary

A USENIX Security 2025 paper tested 16 code-generating models on Python and JavaScript and found that 19.7% of the 2.23 million package references in the generated code (440,445) pointed to packages that do not exist, including 205,474 unique invented names. Commercial models averaged at least 5.2%, open-source models 21.7%. An attacker can register one of those names on npm or PyPI and wait for someone to install it. That tactic is now called slopsquatting.

Severity

Timeline

1. Jun 2024
   Paper first posted to arXiv.
2. Mar 2, 2025
   Revised version (v3) posted to arXiv.
3. Aug 2025
   Presented at USENIX Security 2025 (UTSA, University of Oklahoma, Virginia Tech), where it won a Distinguished Paper Award.

How it happened

Models predict plausible-sounding package names. When one does not exist, the install fails, unless someone has already registered it. The researchers also tested mitigations and report they cut hallucinations significantly while keeping code quality. Rates were measured on the specific model versions in the study; newer models may differ.

How to check your app

• Before installing a package an AI suggested, look it up on npm or PyPI: check age, downloads, maintainer and repo link.
• Use a lockfile and review new dependencies in every pull request.
• Do not let agents run npm install or pip install unattended on packages you have not checked.

Sources

• USENIX Security 2025: We Have a Package for You!
• Paper (arXiv)
• Dark Reading: AI code tools widely hallucinate packages

Corrections and updates

1. Oct 14, 2026
   Corrected the summary: 19.7% is the share of generated package references that were hallucinated (440,445 of 2.23 million), not the share of code samples.