You ask your AI assistant how to do something. It gives you clean, confident code, with an install line at the top:
Except aws-helper-sdk never existed. The model made it up. And last month, someone registered that exact name on PyPI — with malware inside — because they knew the model would suggest it.
That's slopsquatting, and it's the supply-chain attack built specifically for the AI coding era. The name was coined in 2025 by Seth Larson of the Python Software Foundation [1], and unlike most security scares, this one is measured, documented, and already in the wild. Let me walk through how it works, the numbers that make it real, and — the part you actually came for — how to not get caught by it.
You already know typosquatting. An attacker publishes a malicious package called expres, betting that someone, someday, fat-fingers pip install express. It works occasionally, but it depends on a human error, and most people spell express correctly.
Slopsquatting flips the burden of the mistake. You don't have to slip. The AI makes the mistake for you — reliably, confidently, in code that looks completely correct — and the attacker registered the hallucinated name in advance. You did everything right. You just trusted the tool, and the tool invented a dependency that a stranger was already squatting.
That's the whole shift: the vulnerability moved from your carelessness to your trust.
This isn't a thought experiment. The foundational study — "We Have a Package for You!", presented at USENIX Security 2025 — generated 576,000 code samples across 16 different LLMs and checked every package the models recommended [2].
The headline result: 19.7% of all recommended packages were hallucinated — nearly one in five. Across those hallucinations, the researchers logged 205,474 unique non-existent package names [2]. That's not a rounding error; that's a vast, ready-made attack surface.
The rate isn't uniform. Open-source models were worse (up to ~22%); commercial models did better, with GPT-4 Turbo the best performer at 3.59% [3]. And a 2026 re-evaluation of newer frontier models found the range had narrowed to roughly 4.6%–6.1% — better, but nowhere near zero [4]. The problem is shrinking, not gone.
So somewhere between 1-in-20 and 1-in-5 of the package names your AI hands you may point at something that doesn't exist. On its own, that's just an annoyance — a failed install. What turns it into an attack is the next fact.
Here's the insight that makes slopsquatting genuinely dangerous, and it's worth sitting with.
If hallucinations were random — a different made-up name every time — attackers couldn't do much with them. You can't register 205,000 names and hope someone hits the exact one you own. The noise would protect you.
But hallucinations aren't random. When the researchers took 500 prompts that had produced a fake package and re-ran each one ten more times, 43% of the hallucinated names came back on every single run [2]. Same prompt, same model, same invented package, over and over.
It gets sharper. A 2026 cross-model study found 127 package names that five different frontier models all invented identically [4]. Different tools, same phantom dependencies.
That predictability is the exploit. A systematic, repeatable model behavior becomes a namespace an attacker can register in advance [5]. They don't guess — they run the popular models against the popular prompts, harvest the hallucinations that reliably recur, register those exact names with malicious code, and wait. The model does the targeting for them, for free, every time a new developer asks a similar question.
You might think your supply-chain tooling has this covered. Mostly, it doesn't — because it was built for the last attack.
Typosquatting detection works on string similarity: how many single-character edits turn expres into express? That's a sensible defense against typos. But slopsquatted names aren't typos. The same study found that, by edit distance, only about 13% of hallucinated names were simple typos of real packages — nearly half were wildly dissimilar to anything that exists [6]. A name like aws-helper-sdk or fastapi-middleware [5] doesn't resemble a real package closely enough to trip a similarity check. It just sounds plausible — which is exactly what a language model is good at generating, and exactly what makes it slip past a human reviewer who isn't familiar with the specific ecosystem.
The defense built for human error is blind to machine error. That gap is the opening.