Newsbite analysis · AI, DevOps, Programming, Security
Dev.to
Your AI Invented a Package, and an Attacker Was Waiting
The article describes slopsquatting, a supply-chain attack in which an attacker registers a package name that an AI coding assistant has hallucinated, hoping developers or agents will install the malicious package. Unlike typosquatting, which exploits misspelled names, the attack relies on plausible-sounding names generated by AI. The article says the term was coined in 2025 by Seth Larson of the Python Software Foundation and presents research figures on how often models invent package names. It cites rates as high as about 22% for some open-source models, 3.59% for GPT-4 Turbo, and roughly 4.6%–6.1% in a 2026 evaluation of newer frontier models.
The article emphasizes that hallucinations can be repeatable: in one cited test, 43% of invented names recurred across repeated runs of the same prompts, and another study found 127 package names independently produced by five frontier models. Conventional typosquatting defenses may miss these names because many are not close spellings of existing packages. The author recommends treating AI-proposed dependencies as untrusted, checking that packages exist and are legitimate, pinning versions and hashes, limiting installs to approved packages, and reviewing new dependencies in CI. Teams using autonomous coding agents are urged to gate installation behind verification or approval. The article also discloses the author’s connection to Xenition, a company working on install gates, while stressing that the safety principle is more important than any particular tool.
Evaluate adoptionConfidence: MediumImmediate horizonStory: Explainer or recapCybersecurity risk: HighSupply chain risk: High
EvidenceOpinionUnverified claimsNo quotesArticle type: Opinion
Published 30 Sept 2026, 08:50 UTC10 min read
Lead image — Dev.to
Brief
NewsBite reading:AI-hallucinated package names create a software supply-chain risk
TL;DR
- The article defines slopsquatting as registering malicious packages under names hallucinated by AI coding assistants.
- It says some open-source models hallucinated package names at rates up to about 22%; GPT-4 Turbo’s cited rate was 3.59%.
- A 2026 evaluation cited in the article found newer frontier models had package-name hallucination rates of roughly 4.6%–6.1%.
- In a repeated-prompt test, 43% of hallucinated package names recurred on every run.
- A cited cross-model study found 127 package names independently invented by five frontier models.
- The article says only about 13% of hallucinated names were close typos of real packages by edit distance.
- Recommended controls include dependency verification, lockfiles and hashes, approved registries, CI review, and gated installs for coding agents.
Interesting facts
- Repeatable hallucinations can make the same fabricated package name a predictable target across repeated prompts.
- Different frontier models can converge on identical nonexistent package names, extending the potential target pool beyond any one model.
- String-similarity defenses may fail because many hallucinated names are plausible but dissimilar to existing packages.
- The article’s author discloses a professional connection to Xenition, which the article says is working on install gates.
What changed
The article highlights a supply-chain threat pattern in which attackers can target package names repeatedly suggested by AI systems, and frames AI-generated install commands as untrusted input requiring verification.
Unchanged: The article does not report a newly discovered CVE, a confirmed attack campaign, a specific victim, or a change to package managers. Standard dependency controls remain applicable, though the article argues they should account for AI-generated suggestions.
What we still don't know
- The cited studies are identified only by bracketed reference numbers; their titles, authors, methods, and publication venues are not provided in the supplied text.
- The article does not identify a confirmed malicious package, victim, or successful slopsquatting incident.
- It does not quantify how many AI-generated package suggestions are actually registered by attackers.
- The extent to which package registries or AI coding tools have deployed specific mitigations is not established.
Decision signal
Decision brief
Actionable takeaways
- Verify that every AI-suggested package exists and is the intended, trustworthy project before installing it.
- Use lockfiles, pinned versions, and package hashes where supported.
- Route dependency resolution through approved registries, allow-lists, or dependency firewalls.
- Add CI checks and human review for newly introduced dependencies.
- Require approval or verification before autonomous coding agents can run package-install commands.
- Review documentation and READMEs for copied AI-generated install commands.
Decision signal
Evaluate adoption
Action required
Evaluate adoption
Event status
Announced
Next milestone
Other
Technical significance
Meaningful
Competitive impact
Neutral
Source reliability
Medium
Impact certainty
Medium
Novelty
Medium
Execution risk
Medium
Strategic weight
Medium
Trend: Accelerating
- AI-assisted software development
- Software supply-chain security
- Autonomous coding agents and delegated tool use
- Dependency governance and package provenance
Personalized guidance
Audience lens
Board
- Treat AI-assisted development as part of software supply-chain risk oversight.
- Confirm that dependency approval controls also cover AI-generated code and autonomous agents.
CTO
- Ensure package installation is controlled through trusted registries and review processes.
- Assess whether existing dependency scanners rely too heavily on name similarity.
Startup founders
- Adopt lightweight dependency verification and lockfile practices before AI coding use scales.
- Avoid giving autonomous coding agents unrestricted package-install permissions.
Investors
- Monitor whether security tooling adapts to risks created by AI-generated dependencies.
- The article does not establish a specific company-level commercial outcome.
Policy
- The article raises software supply-chain resilience concerns but identifies no particular policy action.
Engineering
- Pin dependencies and use hashes where available.
- Add CI review or approval for newly introduced packages.
Developers
- Treat a model-suggested package name as an unverified claim.
- Check package identity and provenance before running installation commands.
Content creators
- Check package-manager commands in technical documentation before publication to reduce propagation of fabricated dependencies.
Entrepreneurs
- Build AI coding workflows with dependency verification as a default rather than an afterthought.
Sales
- Security vendors can clarify whether dependency controls cover plausible, dissimilar hallucinated names.
Marketing
- Avoid presenting AI-generated code or install instructions as inherently verified or safe.
Accounting
- The article gives no direct finance or accounting action beyond accounting for dependency-security controls in operational planning.
Consumers
- End users could be indirectly affected if compromised dependencies reach software they use; no particular product or user group is identified.
Sentiment signal
Sentiment
Overall: NegativeMood: Cautious
The article is cautionary: it presents slopsquatting as a measurable, repeatable risk while emphasizing that layered dependency controls can reduce exposure. It does not claim a specific successful attack or victim.
Drivers
Reported package-name hallucination rates remain above zeroRepeated prompts can produce identical fabricated namesConventional typo-detection may miss dissimilar namesPractical dependency and agent-install controls are available
By category
SecurityNegative
The article outlines a software supply-chain attack avenue that could result in malicious dependencies entering projects.
ProgrammingNegative
AI-generated code can include fabricated package names, adding verification work and risk to common development workflows.
AINegative
The cited model hallucination rates indicate that package suggestions can be confidently wrong, even in newer systems.
DevOpsMixed
Dependency scanning, CI review, lockfiles, and install gates offer practical mitigations, but existing string-similarity defenses may not detect these names.
Notable entities
Seth LarsonindividualNeutral
The article credits him with coining the term slopsquatting in 2025.
Python Software FoundationorganizationNeutral
The article identifies it as Seth Larson’s affiliation when describing the origin of the term.
GPT-4 TurboproductNeutral
The article cites a 3.59% package-name hallucination rate for this model in a referenced study.
XenitioncompanyMixed
The author discloses working on the company and says it is developing install gates, creating relevant context for the proposed mitigation.
By subject & region
developersgroupNegative
Unchecked AI-generated package suggestions can expose projects to malicious dependencies.
“Treat any package name an LLM gives you as untrusted input”
enterprisesgroupNegative
Unrestricted dependency installation by people or agents can create supply-chain exposure.
“Gate its installs behind verification or approval”
Market signal
Impact & reach
The article reports research-backed risk that AI coding assistants can repeatedly invent package names, potentially enabling attackers to seed malicious packages under those names.
A package installation can introduce third-party code directly into a development or production supply chain. Repeated hallucinations make some nonexistent names potentially predictable, while ordinary typo-detection tools may not recognize plausible but dissimilar names. The suggested controls shift trust decisions from the model to package verification, approved registries, and review gates. The article describes a documented risk and mitigations, not a confirmed incident or evidence that any particular package has been maliciously registered this way.
developersNegative
Developers may unknowingly install malicious dependencies when they trust generated install commands without checking package identity and provenance.
enterprisesNegative
Organizations that permit AI-assisted development or autonomous agents to add dependencies face potential supply-chain exposure unless installation is controlled and reviewed.
startupsNegative
Small teams may rely heavily on AI-generated code while having fewer formal dependency review controls.
Geographic focus
GlobalNegative
The article discusses AI coding tools and open-source package ecosystems without limiting the risk or recommendations to a particular region.
Regional implications
- The article does not identify a country-specific incident, regulatory response, or geographic restriction.
Likely winners
Package security and dependency-scanning vendorsOrganizations operating private package registries or dependency firewallsDevelopment teams with established dependency review processes
Likely losers
Teams that allow unreviewed AI-generated dependencies to installDevelopers and organizations exposed to malicious packages
Neutral / unclear
Package registriesAI coding assistant providersXenition
Ripple effects
Enterprises using coding agentsConfidence: High
May add approval steps or dependency allow-lists to prevent agents from installing unvetted packages.
Package security vendorsConfidence: Medium
May face demand for controls that detect suspicious package introductions beyond simple name-similarity checks.
AI coding assistant providersConfidence: Medium
May be pressed to surface package provenance or gate suggested installation commands more clearly.
Risk signal
Risk radar
Cybersecurity riskHigh
The described technique could introduce malicious code through software dependencies, though no particular successful attack is documented.
Data governance riskLow
The article focuses on dependency integrity, not data collection, processing, or governance.
Reputational riskMedium
A compromised dependency could damage trust in affected software or in AI-assisted development practices.
Execution riskMedium
Implementing verification, allow-lists, and agent approval gates requires workflow changes; the article does not quantify their cost or effectiveness.
Infrastructure riskMedium
A malicious dependency could affect build and deployment pipelines, but the article reports no specific infrastructure compromise.
Geopolitical riskLow
The article describes a software supply-chain threat without identifying a geopolitical actor or state-linked activity.
Regulatory riskLow
No regulatory action or legal requirement is discussed.
Supply chain riskHigh
The central issue is the possibility that attackers register hallucinated package names and developers install them as dependencies.
Talent displacement riskLow
The article does not discuss job displacement or changes to staffing.
AI liability riskMedium
Organizations may need controls around AI-generated dependency suggestions, but the article reports no legal claim or liability ruling.
Sourcing
Sources & evidence
The automated analysis found no sources named in the text.