This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Security researchers have identified a supply chain attack vector dubbed 'slopsquatting,' where AI coding assistants hallucinate non-existent software package names. Attackers monitor these hallucinations, register the fake packages with malicious payloads on public repositories like PyPI and npm, and wait for developers to install them based on AI suggestions. This vulnerability has already resulted in real-world codebases, such as Alibaba's GraphTranslator, incorporating malicious dependencies.
Large language models have reportedly hallucinated non-existent software package names, some of which were subsequently uploaded to public repositories and incorporated into real codebases. In one case, a package named huggingface-cli, which was purported to have been originally suggested by an AI model, was downloaded more than 15,000 times. This dynamic enables what security researchers have termed "slopsquatting," in which attackers register hallucinated package names and introduce potential malware into software supply chains.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that fail to perform reliably or effectively under varying conditions, exposing them to errors and failures that can have significant consequences, especially in critical applications or areas that require moral reasoning.
Also classified as
The hallucinated packages create a security vulnerability in the software supply chain that can be exploited by malicious actors to distribute malware.
Attackers can weaponize these hallucinations to conduct scams or distribute malware, and some have already used AI to generate realistic-sounding fake package names at scale.
The incident is primarily caused by the AI systems' lack of capability and robustness, specifically their tendency to hallucinate non-existent software package names when generating code.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The risk is caused by the AI system's unintentional hallucination of non-existent package names during post-deployment operation.
Added categories peak at 4: Severe (Epistemic Harm, Inferred)
Security researchers identified 'slopsquatting,' a software supply chain vulnerability where attackers register malicious packages matching AI-hallucinated names. This poses a substantial threat to global technological security by introducing vulnerabilities into major codebases, as demonstrated by Alibaba's GraphTranslator project.
The AI systems are described as 'coding assistants' or 'LLM-powered code generation tools' that suggest code snippets to developers. They augment human capabilities but require the developer to copy, validate, and run the code, fitting the 'Assistant' behavior type.
Limited Risk: The systems involved are general-purpose AI chatbots and code generation assistants (like ChatGPT/GPT-4). According to the definitions, chatbots and general-purpose AI systems fall under Limited Risk, requiring transparency obligations so users know they are interacting with an AI.
The AI models were primarily used as coding assistants to generate software code and package recommendations based on user prompts.
The reports provide consistent, detailed, and technically sound explanations of the package hallucination vulnerability ('slopsquatting') across multiple security firms (Lasso Security, Socket) and academic studies. The specific case of Alibaba's GraphTranslator is well-documented, and the mechanics of the vulnerability are clearly explained.
The incident could be viewed purely as a human security issue (typosquatting/supply chain hygiene), but the central role of AI hallucinations in generating the predictable attack surface makes it primarily an AI safety/robustness issue.
Technology
Persistent LLM Hallucinations
Models repeatedly invent plausible but non-existent package names.
Increased Scale Reduces Reliability
Larger models give plausible but wrong answers instead of admitting gaps.
AI Overviews Parroting Fake Info
Search engines summarize and praise fake packages, giving false legitimacy.
Data Inputs
Unverified Package Lists in Prompts
LLMs lack access to real-time verified package databases during generation.
Repetitive Prompt Artifacts
Certain prompts consistently trigger the same hallucinated package names.
Lack of Registry Reference Data
Models generate code without cross-referencing live package registries.
Human Factors
Vibe Coding Blind Trust
Developers copy and paste AI suggestions without verifying if packages exist.
Poor Human Evaluation of LLM Outputs
Humans fail to detect incorrect AI answers 10 to 40 percent of the time.
Overreliance on AI Assistants
Developers assume AI-generated installation instructions are inherently safe.
Process and Methods
Automatic Installation by AI Agents
AI agents install recommended packages directly without human intervention.
Lack of Dependency Verification
Failure to use dependency scanners, lockfiles, or manual package checks.
Permissive Registry Publishing
Public package registries allow immediate registration of hallucinated names.
Management
Prioritizing Speed Over Security
Organizations rush AI integration without establishing safe coding guidelines.
Inadequate AI Risk Assessments
Management fails to assess the supply chain risks of AI-generated code.
No training for developers on AI
No training for developers on the risks of AI package hallucinations.
Regulatory Environment
Lack of LLM Provider Transparency
No regulatory mandate for AI providers to report package hallucination rates.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
