Dateline: July 24, 2026
Slopsquatting Is Not Over
Ask five different AI coding assistants to write you some Python. Odds are decent that at least one will tell you to install a library that does not exist.
Now here is the part that should worry you. When researchers ran that test at scale, the five models did not each make up their own random garbage. They made up a lot of the same garbage.
A new paper posted to arXiv this month found 127 fake package names that all five tested models hallucinated. Identical names. Same made up libraries, over and over. As of April, 53 of those names were still sitting unregistered, waiting for whoever gets there first.
What Happened?
An independent researcher replicated a well known 2025 USENIX Security study on package hallucinations, this time against a newer batch of models: Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2.
The test ran 199,845 paired Python and JavaScript prompts. Every package name the models suggested got checked against the real PyPI and npm master lists.
The headline number looks like progress. Hallucination rates landed between 4.62 percent for the lowest model and 6.10 percent for the highest. Compare that to the older study, where the spread ran from 5.2 percent on commercial models all the way up to 21.7 percent on open source ones. The worst case has dropped hard.
But the gap closing is not the same as the problem going away. The paper notes that no model in this 2026 group beat the best result from 2024. The floor stayed put. Only the ceiling came down.
And then there is the overlap. 127 names, 109 on PyPI and 18 on npm, showed up across all five models. After coordinated disclosure and registry cleanup, 53 remained registrable: 41 on PyPI, 12 on npm.
What’s the Impact?
This is the setup for slopsquatting. An attacker does not need to guess. They just read a paper, pick a name off a list that AI tools reliably suggest, register it, and put whatever they want inside.
The victim never mistypes anything. The victim copies exactly what their coding assistant told them to install. Malicious code walks into the build, and from there into whatever ships.
Shared hallucinations make this worse in a specific way. If only one model invented a bad name, the pool of potential victims is limited to that model’s users. When five models agree, the target list widens to basically everyone writing code with AI help.
One bit of relief: the researcher reports no evidence yet that any of the 53 remaining names have been registered maliciously or used in an attack. That is a point in time finding, not a guarantee. The paper itself says the 53 figure should be treated as a snapshot, since registry rules and taken names keep changing.
How to Avoid This
- Verify before you install. If an AI tool names a package, check it exists on PyPI or npm before it enters your project.
- Treat brand new packages with suspicion. A library with no history, no download count, and a recent creation date deserves a second look, especially if an AI suggested it.
- Pin your dependencies and use lockfiles. Pin exact versions and check lockfiles into source control so nothing unexpected slips into a build.
- Scan in CI, not after. Software composition analysis inside the pipeline catches bad dependencies before a merge, rather than after production.
- Keep an SBOM. When something does go wrong, knowing exactly what is in your software is the difference between a quick fix and a long weekend.
