Slopsquatting

The name was coined in April 2025 by Seth Larson, security developer-in-residence at the Python Software Foundation, by analogy with typosquatting: instead of betting on a human mistyping a real package name, the attacker bets on a model inventing a plausible one. The attack works because public registries such as PyPI and npm allocate names first come, first served, with no link between a name and any real project, and because installation itself runs code: setup scripts in Python source distributions and preinstall or postinstall lifecycle scripts in npm execute with the installing user's rights before anyone imports the package.

The key measurement is Spracklen et al., presented at USENIX Security 2025. Using 16 code-generating models and two prompt datasets, they generated 576,000 Python and JavaScript samples and found 205,474 unique hallucinated package names. The average hallucination rate was at least 5.2% for commercial models and 21.7% for open-source models. Crucially for attackers, hallucinations were persistent: when the same prompt was repeated ten times, 43% of hallucinated names appeared in all ten runs and 58% recurred more than once, so an attacker can harvest names by querying models and register the stable ones. Lower sampling temperature, retrieval of real package lists and self-checking reduced but did not eliminate the effect.

The risk was demonstrated before the name existed. In 2023 researcher Bar Lanyado noticed models recommending pip install huggingface-cli, which is the name of a command, not of the package that provides it; he registered an empty package under that name, and it received over 30,000 downloads within three months, helped by the wrong install command appearing in the README of an Alibaba research repository.

Slopsquatting differs from typosquatting (near-miss spellings of real names) and dependency confusion (a public package shadowing an internal name, demonstrated by Alex Birsan in 2021), but the defences overlap. Verify that a suggested package exists, is the one intended and has a credible history (age, maintainers, linked source repository, download pattern) before adding it; install from lockfiles with pinned hashes (npm ci, pip --require-hashes); route installs through an internal registry proxy with an allowlist or a malicious-package feed; and run software composition analysis in CI. Coding agents need the same controls enforced technically, because they can install dependencies without a person reading the command: restrict registries, disable install scripts where feasible, and run the agent in a sandbox without access to production credentials.