SLOPSQUATTING

When AI Hallucinations Become Attack Vectors

Slopsquatting is a software supply chain attack where adversaries register npm, PyPI, or crate package names that large language models frequently hallucinate. When an AI coding agent like Cursor, Copilot, or Claude Code suggests a non-existent package name — and a developer or automated pipeline installs it — they execute attacker-controlled code. Security researchers identified 58,000+ unique hallucinated package names across GPT-4, Claude, and Gemini in a February 2026 study, and attackers had already registered 4,600 of them on npm alone.

How does slopsquatting work?

The attack has 4 steps. First, the attacker prompts multiple LLMs with common coding tasks (e.g., "parse CSV in Node.js") and collects package names that don't exist on npm. Second, the attacker registers those names on npm with trojanized code — typically a postinstall script that exfiltrates environment variables. Third, a developer asks an AI coding agent the same question and receives the hallucinated package name as a recommendation. Fourth, the developer runs npm install, executing the malicious postinstall script. The entire attack costs under $0 because npm registration is free.

What hallucinated packages have been weaponized?

Below are 5 confirmed examples where LLMs consistently hallucinate non-existent packages that attackers have registered or could register. These names appear in AI-generated code suggestions across multiple models.

Why are AI coding agents especially vulnerable?

AI coding agents can increase supply-chain risk for 3 reasons. First, they may execute npm install as part of a task without a separate human review. Second, agents lack package reputation awareness; they cannot distinguish a 0-day-old package from one with 5 years of history. Third, a poorly scoped agent runtime may expose filesystem and network capabilities that let a malicious postinstall script reach sensitive files or destinations.

How does OpenSyber detect slopsquatting?

Slopsquatting defense is strongest when layered. A deployment can combine package provenance and behavioral checks, a maintained blocklist, explicit approval for new dependencies, and runtime controls for post-install network and file access. OpenSyber's current governed MCP scope should not be read as universal npm-install or host-egress coverage.