Slopsquatting: When AI Hallucinates a Package Attackers Register

Developer adoption of AI coding assistants is no longer an experiment. GitHub Copilot, Cursor, ChatGPT, and Claude now write significant portions of production codebases across enterprise engineering organizations. But generative AI models suffer from a structural vulnerability in software engineering: package hallucination.

When an LLM suggests an import for a non-existent package, it creates a slopsquatting opportunity. An attacker observes or predicts the hallucinated package name, registers it on a public registry like npm or PyPI, and places a malicious payload inside an install script. The next developer who accepts the AI completion or runs npm install executes adversary code on their machine.

This is not a theoretical attack vector. Researchers have repeatedly demonstrated that popular LLMs hallucinate specific package names across thousands of prompts. Adversaries scan model outputs and public pull requests to register these missing names before enterprise security teams notice.

The supply chain race condition: Roughly 20% of AI-generated package recommendations in security research studies reference non-existent libraries. An attacker only needs to register the name once to compromise every developer who accepts the completion.

1. The Anatomy of Slopsquatting

Slopsquatting combines artificial intelligence hallucinations with traditional typosquatting mechanics, but with higher efficiency. In traditional typosquatting, an attacker relies on human typographical errors. In slopsquatting, the attacker relies on deterministic probabilistic patterns inside large language models.

When a developer prompts an AI assistant to solve a complex coding task, the LLM constructs plausible syntax. If a standard library or popular module does not exist for a niche function, the model invents one. It generates clean import statements like import { validateEnterpriseToken } from 'auth-token-validator-utils' or import huggingface_hub_enterprise.

[ Developer Prompt ] -> [ AI Coding Assistant ]
                              |
                              v (Hallucinates non-existent package)
                       "import 'express-async-context'"
                              |
         +--------------------+--------------------+
         |                                         |
         v                                         v
 [ Developer accepts PR ]               [ Attacker discovers hallucination ]
         |                                         |
         v                                         v
 [ Runs `npm install` ]                 [ Registers 'express-async-context' ]
         |                                         |
         |                                         v
         +----------------<---------------- [ Publishes malicious package ]
         |
         v
 [ Remote Code Execution on Developer Workstation ]

The attack sequence unfolds in four steps:

1. Hallucination: An AI assistant suggests a non-existent package name in a code completion or chat response.
2. Discovery: Attackers run prompt farms or monitor public repositories and pull requests for unresolved import errors referencing unregistered packages.
3. Registration: The attacker registers the hallucinated name on npm, PyPI, or Cargo, publishing a release with install-time hooks (postinstall in JS/TS or setup.py / build.rs in Python and Rust).
4. Execution: A developer accepts the suggestion and runs the package manager install command. The registry downloads the attacker package and executes the payload immediately.

2. What Happens Without Detection

Failing to detect slopsquatting creates direct operational, security, and compliance impacts across enterprise environments.

Unclaimed Hallucinations Weaponized into Zero-Day Attacks

Unclaimed package suggestions remain dormant until an external actor registers them. Once registered, the package acts as an instant zero-day supply chain vector. Attackers do not need to compromise an existing maintainer account or push a pull request to your repository. They simply wait for your developers to pull the package they already imported.

Silent Developer Machine Compromise

Modern package managers execute scripts automatically upon installation. A npm install or pip install command triggers arbitrary binary execution before any application code runs. Attackers use these hooks to extract environment variables, harvest cloud credentials (~/.aws/credentials, AZURE_CONFIG_DIR), steal SSH keys, and persist inside internal developer networks.

Poisoned Production Artifacts

When hallucinated packages bypass developer machines and enter build pipelines, they get compiled into container images, serverless functions, and production releases. An attacker payload embedded in a frontend JS bundle can exfiltrate customer session tokens or modify client-side transaction logic directly inside the user browser.

Compliance and Audit Liabilities

Enterprise regulatory frameworks place strict burdens on software provenance:

• EU Cyber Resilience Act (CRA): Mandates strict vulnerability handling and supply chain monitoring for commercial software products sold in the European Union.
• Software Bill of Materials (SBOM): An unregistered package that turns malicious corrupts the accuracy of published SBOMs, invalidating compliance attestations.
• SOC 2 Type II: Inability to account for external code dependencies violates Trust Services Criteria for logical access and system operations integrity.

What This Costs You

The financial and operational losses from a slopsquatting incident escalate rapidly across four categories:

Where This Breaks

Building manual or naive detection mechanisms against slopsquatting fails due to technical edge cases in enterprise software pipelines:

1. Private Scoped Packages: Enterprise codebases rely heavily on private registries and scoped packages (such as @internal/auth or company-private-utils). A basic detection script querying public npm or PyPI registries will flag all private scoped packages as missing (404), generating thousands of false positives that overwhelm AppSec teams.
2. Registry Rate Limits and Throttling: Public registries enforce strict API rate limits. Querying npm (registry.npmjs.org) or PyPI (pypi.org/pypi/<pkg>/json) for every import statement across thousands of commits triggers HTTP 429 Too Many Requests responses. Naive scanner scripts crash or hang build pipelines when rate limits are exceeded.
3. Build Pipeline Latency: Adding deep dependency analysis directly into blocking CI steps can add minutes to build times. If security checks stall developer feedback loops, engineering teams bypass or disable the gates.

3. Technical Grounding: Extraction and Registry Validation

Catching slopsquatting requires extracting every declared import across source files and verifying package existence on target registries before execution.

JS/TS Import Extraction and npm Validation

For JavaScript and TypeScript environments, string matching with regular expressions misses dynamic imports and aliased modules. Reliable extraction parses the Abstract Syntax Tree (AST) using tools like @babel/parser or TypeScript compiler APIs.

The following Python script demonstrates the verification logic against the npm registry API:

import json
import urllib.request
import urllib.error
 
def check_npm_package(package_name: str) -> dict:
    # Ignore enterprise private scopes
    if package_name.startswith("@internal/") or package_name.startswith("@corp/"):
        return {"status": "PRIVATE_SCOPE", "package": package_name}
 
    url = f"https://registry.npmjs.org/{package_name}"
    req = urllib.request.Request(url, headers={"User-Agent": "Enterprise-SupplyChain-Scanner/1.0"})
 
    try:
        with urllib.request.urlopen(req) as response:
            if response.status == 200:
                return {"status": "EXISTS", "package": package_name}
    except urllib.error.HTTPError as e:
        if e.code == 404:
            return {"status": "HALLUCINATED_UNCLAIMED", "package": package_name}
        elif e.code == 429:
            return {"status": "RATE_LIMITED", "package": package_name}
    except Exception as err:
        return {"status": "ERROR", "package": package_name, "details": str(err)}
 
    return {"status": "UNKNOWN", "package": package_name}

Python Import Extraction via AST and PyPI Validation

In Python codebases, parsing the source file using the built-in ast module identifies standard import and from ... import statements accurately without executing module code.

import ast
import requests
 
def extract_python_imports(file_path: str) -> set:
    with open(file_path, "r", encoding="utf-8") as f:
        tree = ast.parse(f.read(), filename=file_path)
 
    imports = set()
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                imports.add(alias.name.split('.')[0])
        elif isinstance(node, ast.ImportFrom):
            if node.module and node.level == 0:
                imports.add(node.module.split('.')[0])
    return imports
 
def verify_pypi_package(package_name: str) -> bool:
    url = f"https://pypi.org/pypi/{package_name}/json"
    response = requests.get(url, timeout=5)
    if response.status_code == 404:
        # Package does not exist on PyPI -> Potential Slopsquatting Risk
        return False
    return True

4. Continuous Automated Detection and Defense

Enterprise security teams cannot rely on manual code reviews to catch AI package hallucinations. Mitigating slopsquatting requires continuous automated validation embedded into the software development lifecycle.

[ Developer Commit / PR ]
           |
           v
 [ Pre-Install CI Gate ]
           |
           +---> 1. AST Import Extraction (JS/TS, Python, Go, Rust)
           |
           +---> 2. Filter Known Internal / Private Scopes (@corp/*)
           |
           +---> 3. Async Registry API Check (npm / PyPI HTTP 404 Verification)
           |
           v
 [ Decision Engine ]
    |         |
    |         +---> (HTTP 404 Found) -> BLOCK BUILD & Alert AppSec Team
    |
    +---> (Package Exists) -> Pass to Dependency Scanner & Allow Install

Verifiable Pre-Install CI Gates

Implement CI checks that run before npm install or pip install commands execute in build pipelines. Extract all imports from changed files, filter out standard libraries and known internal packages, and verify registry status asynchronously. If an unmapped 404 package is found, fail the build job immediately before any package manager downloads code.

Closing the Hallucination-to-Registration Race Condition

Automated scanning scripts running continuously against new pull requests identify missing packages within seconds of code submission. When an internal build identifies a valid hallucinated package name that your application actually needs, enterprise security teams can preemptively register the package name internally or on public registries to prevent external claim.

Continuous Supply Chain Hygiene and Audit Evidence

Automated verification provides verifiable evidence for security audits. Every build logs dependency verification results, generating audit-ready records that demonstrate proactive supply chain controls for CRA, SOC 2, and ISO 27001 requirements.

Building Continuous Supply Chain Validation

AI coding assistants increase developer speed, but they shift supply chain risk to the immediate point of code creation. Waiting for traditional SCA tools to index malicious packages after publication leaves developer machines and build environments exposed.

Security organizations need continuous, automated workflow execution that monitors code repositories, extracts dependency structures at scale, and validates packages across global registries in real time.

We built Trickest to make offensive security and continuous attack surface validation programmatic. Across millions of execution jobs and hundreds of thousands of orchestrated nodes, deterministic security workflows give enterprise teams the speed and coverage required to stay ahead of automated adversaries.

Explore how to orchestrate continuous supply chain checks with Trickest.