AI hallucinated packages and slopsquatting

Your AI coding tool says "run npm install some-helpful-lib." You paste it into the terminal and it works. But what if that package did not exist when the model was trained, and someone registered the name last week because AI tools keep suggesting it?

That is a package hallucination attack, often nicknamed slopsquatting. It targets exactly the workflow vibe coders use most: accept the AI's code, install what it asks for, ship.

What the research found

Researchers at UTSA, the University of Oklahoma, and Virginia Tech generated 576,000 Python and JavaScript code samples with 16 code models and checked every recommended package against npm and PyPI (Spracklen et al., "We Have a Package for You!"):

• 19.7% of recommended packages did not exist, with 205,474 unique invented names.
• Commercial GPT models averaged about 5.2%, open source models 21.7%.
• JavaScript had more hallucinations than Python (21.3% vs 15.8% on average).
• Hallucinations repeat: 43% of invented names came back in all 10 repeats of the same prompt, and 58% came back more than once. That repeatability is what makes the names worth registering for an attacker.

Most invented names were not one-letter typos of real packages, so "does it look like a typo" is not a reliable check. Newer models may hallucinate less, but the authors found it in every model they tested.

How the attack works

1. Attacker prompts popular AI tools with common tasks and collects package names that do not exist.
2. Attacker publishes packages under those names on npm or PyPI. Often they even work, so nothing looks wrong.
3. The package includes an install script or hidden code that steals environment variables, tokens, or SSH keys from the machine that installs it, or from your server at runtime.
4. You install it because your AI tool suggested it.

npm lists typosquatting and malicious uploads among the main threats it faces (npm: threats and mitigations). Hallucinated names are a new source of the same kind of bad names.

The 2-minute check before you install

Do this for every package your AI tool adds that you have not used before.

1. Look it up on the registry, not in the chat. Open npmjs.com/package/<name> or pypi.org/project/<name> in your browser, or run:

npm view <name> name description repository time.created maintainers

(npm view docs). If it says 404, the AI invented it. Do not install it, and ask the tool for a well known alternative.

2. Check the warning signs.

• Created very recently, or only one version
• Very few weekly downloads for something that claims to be a common utility
• No repository link, or the repository does not match the package
• Publisher has no other packages
• An install script (preinstall, install, postinstall) in a package that should not need one

3. Prefer the obvious package. For common jobs, use the well known library from the official docs of the framework or service you are using (for example the official stripe, @supabase/supabase-js, or openai SDKs). If the AI suggests a wrapper with a creative name, ask why the official SDK does not work.

4. Install without scripts for a first look if you are unsure:

npm install <name> --ignore-scripts

The ignore-scripts option stops npm from running package scripts during install (npm docs). With pnpm, dependency build scripts need your approval through pnpm approve-builds. Do not approve scripts for packages you do not recognize.

Make it a habit in your project

• Commit your lockfile (package-lock.json, pnpm-lock.yaml) and install with npm ci in CI and deploys, so builds use exactly the versions you reviewed.
• Read the diff of package.json after every AI change. New dependencies should never be a surprise. If you use pull requests, GitHub dependency review shows added packages in the PR.
• Turn on Dependabot alerts for known vulnerable versions (GitHub docs). It will not catch a brand new malicious package, but it catches the much more common old-vulnerable-version problem.
• Run npm audit signatures to check registry signatures and provenance where packages provide them (npm provenance). Provenance links a package to its source and build, but npm notes it does not guarantee the code is safe.
• Tell your AI tool the rule. Add a line to your project rules file (.cursor/rules, AGENTS.md, CLAUDE.md): "Do not add new dependencies without asking. Prefer official SDKs and packages already in package.json."
• Check MCP servers the same way. An npx -y line in mcp.json installs a package too, and that package gets your API keys. The MCP server security guide covers pinning versions and finding the official server.
• Keep secrets out of reach. A malicious package running on your laptop can read .env files. Use separate, low-privilege development keys, and never put production secrets in local files. See keep secrets out of frontend code.

If you already installed something suspicious

1. Remove it from package.json, delete node_modules and the lockfile entry, and reinstall.
2. Check whether it had an install script. If it did, assume it ran.
3. Rotate every secret that was in environment variables or .env files on that machine or in that build: API keys, database URLs, tokens. The first hour after an API key leaks walks through rotation.
4. Report the package to npm or PyPI through the "Report malware" link on its page.

Checklist

• Every new package checked on npmjs.com or pypi.org before install
• Age, downloads, repository, and publisher look normal
• No unexpected install scripts
• Official SDKs preferred over unknown wrappers
• Lockfile committed; CI uses npm ci
• package.json diff reviewed after every AI change
• Dependabot alerts on
• Project rules tell the AI not to add dependencies without asking

Ask your AI coding tool to check

Give this prompt to Cursor, Lovable, Bolt, or Claude Code inside your own project:

List every dependency in package.json (and requirements.txt if present) that was
added in the last month or that is not a widely used, well known package. For
each, give the npm or PyPI URL so I can verify it exists, what it is used for in
this codebase, and whether an official SDK or an existing dependency could
replace it. Do not install or add any new packages while doing this.

Then open each URL yourself. The AI cannot be the one to confirm its own suggestions are real.

Sources

• Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (arXiv)
• npm: Threats and mitigations
• npm: npm view
• npm: npm ci and ignore-scripts
• npm: Generating provenance statements (npm audit signatures)
• pnpm: approve-builds
• GitHub: About Dependabot alerts
• GitHub: About dependency review