WTF is Slopsquatting?
Registering a malicious package under a name that AI coding tools predictably hallucinate.
Also called: package hallucination attack
TL;DR
LLMs sometimes invent package names that don't exist. Worse, they invent the same fake name again and again. An attacker publishes real malware under that name, and the next developer who pastes the AI's `pip install` line gets owned. Typosquatting exploits human typos; slopsquatting exploits AI slop.
How it works
Package hallucination is when generated code imports or installs a library that exists in no registry. Studies found a large share of hallucinated names recur across repeated prompts, which makes them a reliable target. Mitigations: verify every dependency an agent adds, use lockfiles and private registries with allow-lists, scan new dependencies for age and provenance, and never auto-install packages in autonomous runs.
Origin
- Coined / introduced by
- Seth Larson (Python Software Foundation)
- When
- Apr 2025
- Story
- Coined by the PSF's security developer-in-residence after research showed how repeatable package hallucinations are.