Slopsquatting is a supply-chain attack that starts with an AI hallucination. A model writing code suggests a package that does not exist. An attacker registers that name on npm or PyPI and fills it with malware. The next developer whose model suggests the same name installs it without looking, and the attacker's code runs inside their product.
The name combines "slop", a term for careless AI output, with typosquatting. Seth Larson, security developer-in-residence at the Python Software Foundation, coined it, and Andrew Nesbitt of Ecosyste.ms popularised it. The attack requires no mistake on your part. The model makes the mistake and you inherit it.
Researchers at the University of Texas at San Antonio, Virginia Tech, and the University of Oklahoma tested 16 code-generation models on 576,000 Python and JavaScript samples. The models recommended packages that did not exist 19.7% of the time, which works out to more than 205,000 invented names. Commercial models did better than open ones, roughly 5.2% against 21.7%, but none of them was clean.
The more useful finding is that the inventions repeat. When the researchers re-ran prompts that had produced an invented package, 43% of those names came back in all ten re-runs. Models do not invent randomly, they invent the same names over and over. That makes the names predictable, so an attacker can harvest them today and register them, knowing models will keep suggesting them tomorrow.
In July 2026, Socket measured that directly. Five leading AI models, 199,845 code responses drawn from about 40,000 prompts, with invention rates running from 4.62% to 6.10%. All five models invented the same 127 package names, and after review, 53 of those were still free for anyone to register: 41 on PyPI and 12 on npm. One registration reaches every team using any of those models.
A researcher, Bar Lanyado, registered huggingface-cli, a name AI models kept suggesting. His package was empty, deliberately. It was downloaded more than 30,000 times in three months and turned up inside Alibaba's public repositories. Every one of those downloads was a developer installing something that was never real. Had the package carried a payload, it would have run 30,000 times.
In January 2026, Charlie Eriksen found react-codeshift, a package that never existed, in a single commit of 47 LLM-generated agent skills. It spread to 237 repositories through forks. No human read the import statement at any point along the way.
For teams running coding agents, that is the whole problem. The agent writes the code and the agent installs the package, and there may be nobody in the loop until something has already gone wrong.
Most teams never review AI-written code line by line, packages included. The model adds an import, the install succeeds, the tests pass, and the pull request merges. A successful install proves nothing here, because registering the package is the attack. "It installed fine" is exactly what a slopsquat looks like.
Agents make it worse again. A developer might pause at an unfamiliar package name. An agent will not. It writes, installs, and carries on, at a rate no manual review keeps up with.
Three layers, in order of effort.
Treat every model-suggested package as unverified input. Before the first install, look it up on the registry. Check the age, the download count, the publisher, and whether it links to a real repository. A package created last week with no history is a red flag however plausible its name sounds.
Make new packages visible in review. Commit lockfiles, and make "this pull request adds a package" something a human actually sees. Most slopsquats are obvious once somebody checks the package, and the attack depends on nobody checking.
Automate the check on every pull request. Manual vigilance does not scale to an agent that opens ten pull requests a day. Vybscan does this as a GitHub App: every pull request and push is checked for packages that look invented or typosquatted, every dependency is checked against OSV and the GitHub Advisory Database, and daily rescans catch names that turn malicious after you merged. Connect a repository and you will see the list in a few minutes.
We have written before about what happens when this class of attack runs end to end, when an AI ran a dependency-confusion attack on its own and 15 machines executed the payload. Slopsquatting arrives at the same weak point from the other direction. The package list is the part of an AI-written change that gets read least, and it is where that code is most exposed.
No. Typosquatting waits for a human to mistype a real package name. Slopsquatting waits for a model to repeat an invented one. There is no typo to catch, because the name was never real. And because hallucinations repeat, an attacker can predict which invented names are worth registering.
Across 16 models and 576,000 code samples, 19.7% of recommended packages did not exist. The best commercial model still invented names in about 3.6% of cases. In Socket's July 2026 test of five current leading models, invention rates ran from 4.62% to 6.10%.
The best-known registrations were research. The huggingface-cli experiment carried no payload, and react-codeshift was caught. But 30,000 downloads of a package that never existed shows the delivery path works end to end, and the economics favour someone eventually using it for real.
Every pull request and push: package names screened for typosquat and slopsquat patterns, dependencies checked against OSV and the GitHub Advisory Database, secrets, licence risk, and infrastructure-as-code posture, plus a daily rescan of what you already merged. It installs as a GitHub App with no CI to configure.
Sources: 53 slopsquatting targets across five frontier LLMs, Socket (Jul 2026) · Slopsquatting and AI package hallucination attacks, Aikido · The UTSA, Virginia Tech and Oklahoma package-hallucination study, via Socket's analysis · AI hallucinations lead to a new cyber threat, CSO Online.
SCA, secrets, and SAST on every GitHub pull request, with a built-in dashboard.
Try Vybscan →