Slopsquatting

When suggesting code, language models regularly invent libraries that do not exist — and do so surprisingly consistently: the same question often yields the same fictional name. Attackers collect these recurring hallucinations, register the names in public registries and ship malicious code. Unlike classic typosquatting no typo is required; the attack path runs through trust in the assistant. It is especially effective in agentic setups where a coding agent installs dependencies autonomously. Effective countermeasures are allowlists, lockfiles, registry proxies and a review step that checks every new dependency against known metadata such as age, downloads and repository history.

Marketing and product teams increasingly run their own tools, landing pages and automations with AI assistance. That is exactly where security review is often missing — a single compromised package can leak tracking data, leads or credentials.

An assistant suggests the package "consent-mode-helper" for an analytics script. It sounds plausible but has existed for two days, has no repository link and, once installed, exfiltrates environment variables to a third-party endpoint.

Researchers documented in 2024 and 2025 that a substantial share of AI-generated package recommendations point to non-existent libraries and that these hallucinations are reproducible. The term slopsquatting emerged in 2025 by analogy with typosquatting. As autonomous coding agents spread, the topic became a standard item in supply-chain security policies and major registry guidance in 2026.