A 2026 re-run of the original slopsquatting research found 127 hallucinated package names that five unrelated frontier models — Claude, GPT, Gemini, and DeepSeek among them — all invented identically. That’s the detail that turns this from a curiosity into a structural risk: an attacker doesn’t need to profile one vendor’s quirks, because the models converge on the same wrong names. This entry extends our Limitations Ledger to AI-hallucinated software packages and the squatting attacks built around them — what’s proof-of-concept, what’s a confirmed in-the-wild incident, and what the registries have and haven’t done about it.
What slopsquatting is, and who named it
The term was coined in April 2025 by Seth Larson, the Python Software Foundation’s Security Developer-in-Residence, and popularized by Andrew Nesbitt, creator of Ecosyste.ms (Wikipedia). At least one source attributes the coinage instead to researcher Charlie Eriksen; the Larson/April-2025 account is corroborated across more independent sources, including a contemporaneous April 2025 writeup, so we’re treating it as the better-supported claim rather than presenting both as equally weighted.
The mechanism: a coding assistant hallucinates a plausible-sounding but nonexistent package name in its output. If a user copies the suggested install command without checking, and an attacker has registered that exact name on the real package registry in advance, the user installs whatever the attacker put there instead.
The founding proof-of-concept, corrected
The case that put this on the map: security researcher Bar Lanyado of Lasso Security registered an empty, placeholder PyPI package under a name he’d observed multiple models hallucinate repeatedly. It was downloaded roughly 30,000 times over about three months — a minority of sources cite a lower figure near 15,000, but 30,000 is the better-corroborated number. The detail that makes this more than an academic exercise: Alibaba had copy-pasted the hallucinated install command into a public GitHub repository’s README, meaning a major company’s own documentation propagated a package name that didn’t exist until a researcher claimed it. The correct package installs via pip install -U "huggingface_hub[cli]"; the hallucinated variant was a plausible near-miss. This was a researcher’s proof-of-concept with no malicious payload, not an attack with a victim — worth stating plainly, since it’s often cited in ways that blur that line. (An earlier, less careful read of this case attributed it to Endor Labs; we could not confirm Endor Labs’ involvement and are correcting that here. The researcher and firm are Bar Lanyado and Lasso Security.)
The academic baseline, and how it moved
The foundational study is Spracklen et al., “We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs” (USENIX Security 2025), which tested 576,000 Python and JavaScript samples across 16 models. Open-source models hallucinated packages at an average rate of 21.7%; commercial models averaged around 5.2%, with GPT-4 Turbo best at 3.59% (arXiv:2406.10279). A repeatability test in the same study is an underappreciated finding: re-running the identical prompt ten times, 43% of hallucinated names recurred in every single trial, while 39% never recurred at all. That stability is what makes a meaningful share of these names predictable, exploitable targets rather than one-off noise.
A 2026 re-evaluation, “The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort” (Aleksandr Churilov, arXiv:2605.17062, submitted May 16, 2026), re-ran the methodology on five models released between October 2025 and March 2026: Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2, across 199,845 paired prompts validated against the real PyPI and npm package lists. The range narrowed sharply to 4.62% (Claude Haiku 4.5, cohort low) to 6.10% (GPT-5.4-mini, cohort high) — genuine progress on the raw rate. Two findings complicate the “models have mostly fixed this” reading: the rate narrowed, not disappeared, and Haiku scored better than the larger Sonnet within Anthropic’s own lineup, cutting against the assumption that bigger models hallucinate less. Most significantly, 127 of the invented names — 109 for PyPI, 18 for npm — were identical across all five models, meaning the vulnerability isn’t model-specific: an attacker who identifies one of these shared hallucinations has a target that works regardless of which assistant a given developer happens to be using.
Following disclosure, registry-level naming rules had already incidentally blocked some of these: PyPI’s prohibited-name and normalization rules caught 68 of the 109 Python names before they could even be registered, per Socket’s gloss on the paper (Socket). That still left 53 of the 127 shared hallucinated names — 41 on PyPI, 12 on npm — registrable at the time of the study.
We found no published study measuring package-hallucination rates specifically for the current frontier generation — GPT-6, Claude Opus/Sonnet 5.x, Gemini 3.x/4.x, Grok 4.x, or the newest open-weight releases. General hallucination benchmarks like AA-Omniscience exist for these models, but they measure open-domain factual guessing, not package-name invention, and conflating the two would repeat exactly the kind of measurement error this site’s methodology rules warn against. The most-cited package-hallucination figure in the field is now roughly six months stale relative to the newest models, which is itself worth noting as a gap rather than papering over with a borrowed number.
From proof-of-concept to confirmed incident
The unused-imports npm package marks a genuine escalation: not a researcher demonstrating feasibility, but a real malicious package registered under a name that plausibly stands in for the legitimate eslint-plugin-unused-imports. It was flagged under GitLab/OSV advisory MAL-2025-48781 on October 27, 2025, classified as embedded malicious code, with no fix available because the package itself is the threat (GitLab Advisory Database). Despite npm placing it under a security hold, it was still logging roughly 233 downloads per week as of early February 2026, per two independent vendor write-ups — a hold stops new discovery, not installs already wired into existing CI pipelines and build scripts. Security researchers describe this as among the first confirmed in-the-wild slopsquatting incidents against a mainstream registry, as distinct from a proof-of-concept.
A second case, react-codeshift on npm (January 2026), spread through at least 237 repositories via AI-generated agent “skill” files, per Aikido Security. Sources disagree on intent here: one account frames it as a hallucinated name conflating two real tools rather than a deliberately planted attack package. We’re presenting both readings rather than asserting malice as settled.
Worth distinguishing explicitly: the May 2026 compromise of 170-plus npm packages and two PyPI packages tied to TanStack and Mistral AI tooling was a supply-chain compromise of existing, real packages — not a hallucinated-name squat. It’s a different attack class and shouldn’t be cited as a slopsquatting example, even though the two get conflated in some coverage.
What the registries and AI coding tools have actually done about it
Neither PyPI nor npm has shipped a defense purpose-built for slopsquatting; existing registry protections mostly target typosquatting — names that closely resemble a real package — which structurally can’t catch an entirely invented name with no close match. The incidental blocking of 68 hallucinated PyPI names, noted above, is a side effect of general naming rules, not a targeted fix. A cottage industry of third-party scanning tools (SlopGuard, Slopcop, Slopstop, and similar) has emerged to check publisher reputation, package age, and postinstall scripts, but we found no independent evaluation of how well any of them actually work, so we’re not endorsing a specific one. We also found no public announcement from GitHub Copilot, Cursor, or Claude Code of a vendor-side mitigation specifically targeting hallucinated-dependency suggestions — a real gap, given how directly this risk sits inside what those tools generate every day. For the broader security record of AI coding assistants, see our GitHub Copilot vs Cursor limitations entry.
The ledger at a glance
| Finding | Measured result | Source, date |
|---|---|---|
| Package hallucination rate, 2026 cohort | 4.62% (Claude Haiku 4.5, low) – 6.10% (GPT-5.4-mini, high) | arXiv:2605.17062, May 2026 |
| Cross-model shared hallucinations | 127 identical invented names across 5 unrelated models | arXiv:2605.17062, May 2026 |
| Registry naming rules as incidental defense | 68 of 109 hallucinated PyPI names pre-blocked by normalization rules; 53 of 127 still registrable | Socket gloss of arXiv:2605.17062, 2026 |
| Founding proof-of-concept | ~30,000 downloads over ~3 months; propagated via Alibaba’s own public README | Bar Lanyado / Lasso Security, 2024 |
| First confirmed in-the-wild incident | Malicious package held by npm, still ~233 downloads/week months later | GitLab Advisory MAL-2025-48781, Oct 2025 |
| Repeatability of hallucinated names | 43% of names recur in 10/10 identical reruns; 39% never recur | Spracklen et al., USENIX Security 2025 |
| Current-generation model data | No study found for GPT-6 / Claude 5.x / Gemini 4.x / Grok 4.x specifically | Gap as of Nov 2026 |
FAQ
Has slopsquatting caused real, confirmed damage, or is it still theoretical?
Both, and the line matters. The founding huggingface-cli case was a researcher’s proof-of-concept with no malicious payload. The unused-imports npm package is a confirmed malicious package that was still being downloaded weeks after npm flagged it — the clearest evidence so far that this has moved from theoretical to real, even though we don’t have a confirmed count of actual downstream breaches versus download counts.
Have newer AI models gotten better at not hallucinating packages?
The 2026 re-evaluation found the rate narrowed from the 2025 baseline (21.7% open-source average down to a 4.62–6.10% band across the cohort tested), but it didn’t disappear, and the newer study found 127 names that five different models all invented identically — meaning the risk is partly model-independent. No study has yet measured rates for the newest 2026 frontier releases specifically.
Do PyPI or npm have a dedicated defense against this?
Not a purpose-built one. General naming and normalization rules incidentally blocked a share of hallucinated names in the one study that checked, but neither registry has announced a slopsquatting-specific control, and none of the major AI coding assistants we checked (Copilot, Cursor, Claude Code) has announced a vendor-side mitigation either.
Last updated November 9, 2026. This page is refreshed as benchmarks and scores move.