Slopsquatting: When the Agent Installs a Package That Never Existed

19.7% of packages recommended by code-generating LLMs do not exist. That figure comes from a USENIX Security 2025 study ("We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs," from UT San Antonio, Virginia Tech, and the University of Oklahoma) that tested 16 models across 576,000 Python and JavaScript code samples and observed more than 205,000 unique hallucinated package names. An attacker who registers one of those names owns every project whose agent installs it. This casebook entry is the threat that motivates a deny-by-default install path; the environment that contains it is the rest of this section.

The vector has a name: slopsquatting, coined by Python Software Foundation Developer-in-Residence Seth Larson in April 2025 and popularized by Ecosyste.ms creator Andrew Nesbitt. It is typosquatting's AI-era cousin: typosquatting bets on human typos, slopsquatting bets on model hallucinations. Unlike the other entries in this casebook, this is a class of attack publicized across 2025, not a single named breach on a single date.

The hallucinations are predictable, and predictable means weaponizable

A one-off hallucination is a build failure. A repeatable one is an attack surface. The USENIX team re-ran 500 hallucination-triggering prompts ten times each: 43% of hallucinated package names reappeared on every single run, and 58% reappeared more than once. Only ~39% never came back.

So the attack loop is cheap. Prompt a model, note which fake names it reliably invents, pre-register those exact names on PyPI or npm with malicious payloads, and wait. The model does the distribution for you, on every developer and every agent that asks it a similar question.

The names are also plausible, not random:

Hallucination rates vary widely by model: open-source models averaged ~21.7% versus ~5.2% for commercial ones, with CodeLlama 7B/34B above 33% and GPT-4 Turbo best at 3.59%. The spread matters for agent fleets: the model you route a task to changes your supply-chain exposure. One more wrinkle: ~8.7% of hallucinated Python package names existed as real npm packages, cross-ecosystem confusion an attacker can also exploit.

The proof of concept got 30,000 downloads

Security researcher Bar Lanyado of Lasso Security registered huggingface-cli, a name LLMs frequently hallucinated, as an empty package on PyPI. It received over 30,000 downloads in three months and was reportedly referenced in major companies' pipelines. The payload was benign because a researcher got there first. The downloads were real.

The vector grows with trust in AI output. "Vibe coding," accepting AI-generated implementations wholesale, removes the manual step where a human would have noticed the package did not exist last week. Hallucinated names land directly in requirements.txt and package.json, and an autonomous agent with install permissions executes the mistake without a human in the loop at all.

The agent is the victim, not the channel, so context hygiene does not help

Most entries in this casebook involve an attacker injecting instructions into an agent's context. Slopsquatting needs no injection. The model attacks itself: its own output, treated as trusted, pulls the payload in. That is why context-hygiene defenses, the lethal-trifecta discipline that contains prompt injection, do not help here. The fix has to live in the install pipeline, because the flaw is treating an LLM's output as anything other than untrusted input to the build system.

The coverage's mitigations point the same direction: dependency scanning before install, lockfiles and allowlisted registries, human verification of every AI-suggested dependency. Model self-checking helps at the margin (GPT-4 Turbo and DeepSeek detect their own hallucinations with 75%+ accuracy) but reduces the rate rather than eliminating the risk.

What contains it: an install-pipeline gate so nothing installs on the model's say-so

An agent asking for a package is a claim, not an authorization. The environment is the layer that can check the claim before any install script runs:

• Deny-by-default registry access. Agents install only through an allowlisted registry, mirror, or curated proxy, so a hallucinated name resolves to nothing instead of to an attacker's upload. This is egress control applied to the one channel teams usually leave unmediated.
• Release-age cooldown. Newly published versions wait out a quarantine window before they are installable, blunting the fresh-upload race that squatting depends on. The package managers have converged on this: npm shipped minimumReleaseAge in February 2026, and pnpm, yarn, and uv carry the same idea under other names.
• Dependency diff at the review gate. A new package is a reviewable event surfaced at review, not a line buried in a lockfile.

This combination is the handbook's prescription, not observed industry practice. The four major agent platforms all gate the network host and none gates the package identity: allowing registry.npmjs.org admits every package on it, slopsquats included. No platform in the corpus ships the full install-time identity gate today, including Wallfacer, which funds this guide and is graded on its published docs like every other case study. The full argument and build spec live at dependency provenance, the seventh compliance property, and the workflow handling at hallucinated dependencies. The numbers above are why the gate is worth building anyway: a 19.7% hallucination rate with 43% repeatability, and the Nx s1ngularity incident already showed what a compromised dependency chain does once it is inside an AI tool.