Slopsquatting

How slopsquatting works

The attack begins with an ordinary AI hallucination. A developer asks a coding assistant for help. The assistant recommends a library that sounds real but does not exist.

That creates an opening:

1. A model repeatedly invents the same believable package name.
2. An attacker notices the hallucinated name.
3. The attacker registers a real package under that name on npm, PyPI or another registry.
4. Another developer receives the same AI suggestion and installs the attacker's package.

That is slopsquatting: turning a model's recurring mistake into a software supply-chain trap.

Why hallucinated packages are dangerous

A random fake package name is not especially useful to an attacker. A fake name that a model invents repeatedly is different: the assistant itself keeps recommending it.

A study presented at USENIX Security 2025 tested 16 code-generating models across 576,000 Python and JavaScript samples. Of 2.23 million package recommendations, 19.7 percent referred to packages the researchers determined did not exist. Rates varied sharply by model type and configuration.

The huggingface-cli experiment

Security researcher Bar Lanyado demonstrated the basic risk before the name slopsquatting existed. After seeing models repeatedly recommend a nonexistent Python package called huggingface-cli, he registered a harmless package under that name in early 2024. It received more than 30,000 downloads in three months.

Nobody needed to break into a developer's computer. The hallucinated recommendation did the advertising.

Where the name came from

Python security developer Seth Larson suggested the name during a conversation with developer Andrew Nesbitt in April 2025. Nesbitt posted it publicly, and the label caught on.

It plays on typosquatting, where an attacker registers a misspelled version of a legitimate package or domain. With typosquatting, the user makes the mistake. With slopsquatting, the model does.

How developers can avoid it

Before you run that install command from the chatbot, check that the package exists. This is exactly how slopsquatting gets you.

Example written for this dictionary.

The practical defense is to check the package, publisher and release history before running a generated install command. That matters even more when vibe coding makes it tempting to accept the assistant's recommendation without review.

Source & further reading

Socket: The Rise of Slopsquatting

Spracklen et al.: We Have a Package for You! (USENIX Security 2025)

Andrew Nesbitt: Slopsquatting meets Dependency Confusion