LLM Package Hallucinations Fuel Slopsquatting Supply-Chain Attacks

Researchers and security vendors warned that slopsquatting has evolved into a practical software supply-chain threat as code-generating LLMs repeatedly recommend nonexistent package names that attackers can register and weaponize. An arXiv study, We Have a Package for You!, found that 19.7% of packages suggested by tested code-generation models did not exist, reinforcing earlier demonstrations that hallucinated names are often stable enough to be predicted and abused rather than being purely random errors.

The threat has expanded from misleading human developers to compromising AI coding agents and automated workflows. Reporting cited the spread of the hallucinated npm package react-codeshift across 237 repositories, continued downloads of a malicious package named unused-imports, and a newer HalluSquatting technique that combines hallucinated resources with prompt injection to steer AI-assisted development tools into fetching and executing attacker-controlled code.