Every fifth software package that language models persistently recommend adding to a project has never been published in official repositories. The eagerness of AI assistants to provide an answer at any cost has led to the emergence of a new supply-chain threat vector — Slopsquatting.
The Essence of the Threat
The term, coined in the spring of 2025 by Python Software Foundation security specialist Seth Larson, describes a straightforward scheme: attackers proactively register in PyPI, npm, or other package registries the names of libraries that neural networks most frequently hallucinate in their responses to developers.
When a developer practicing "vibe coding" copies instructions suggested by the model, such as pip install or npm install, they end up downloading not a time-tested library, but someone else's placeholder package or malicious code embedded by the author of the hijacked name.
Scale of the Problem: USENIX Security 2025 Data
Researchers tested 16 popular generative models (including variants of GPT-4, DeepSeek, and CodeLlama) across half a million Python and JavaScript code samples. The results of the academic report revealed an alarming scale:
| Metric | Value |
|---|---|
| Average share of hallucinated libraries among recommendations | 19.7% |
| Hallucination rate in Open-Source models | 21.7% |
| Hallucination rate in commercial services | 5.2% |
| Worst result (CodeLlama family) | over 33% |
| Best result (GPT-4 Turbo) | 3.59% |
| Total number of unique non-existent names | over 205,000 |
The primary danger lies in the repeatability of these errors. The study revealed that in 43% of cases, a model outputs the exact same hallucinated library across each of 10 repeated queries on the same topic. Moreover, about 81% of generated names are unique to a specific model. For an attacker, simply automating the collection of recurring hallucinations from a single popular AI tool is enough to build a database for hijacking.
From Theory to Practice
The mechanics worked in practice even before the official term was introduced. In 2023, researcher Bar Lanyado noticed that models regularly suggested installing a non-existent package named huggingface-cli (the original utility is installed via a flag using huggingface_hub[cli]). A harmless placeholder he registered gained over 30,000 downloads within a quarter and even made its way into the official documentation of external projects.
Testing current versions of ChatGPT, Claude, Gemini, and DeepSeek on niche tasks yields similar results: assistants confidently recommend installing phantom utilities (such as colourscie or cie-lch-utils), generating detailed usage examples for packages that do not exist in PyPI.
The Feedback Loop Effect
Cybersecurity specialists point out a fundamental issue with slopsquatting: the attack is capable of sustaining itself over time. Fictional imports hallucinated by models find their way into open repositories, tech blogs, and build scripts. Next-generation LLMs are subsequently trained on these open sources, further reinforcing the probabilistic model's conviction that the non-existent package is real.
How to Minimize the Risks
To prevent contamination of build pipelines, teams are advised to reconsider how they integrate AI into their workflow:
- Zero-Trust Principle: manually audit every import suggested by a neural network. Verify the existence of a GitHub repository, registration date, and download statistics on PyPI/npm before running any install command.
- System Prompt Constraints: explicitly instruct the assistant not to invent external modules. The model should provide a clean implementation using the language's standard library if it is unsure about a specific dependency.
- Verification Tools: integrate search agents and MCP tools that check package registries before delivering final code to the user.