Loading story…
Researchers and security vendors warned that slopsquatting has evolved into a practical software supply-chain threat as code-generating LLMs repeatedly recommend nonexistent package names that attackers can register and weaponize. An arXiv study, We Have a Package for You!, found that 19.7% of packages suggested by tested code-generation models did not exist, reinforcing earlier demonstrations that hallucinated names are often stable enough to be predicted and abused rather than being purely random errors.
The threat has expanded from misleading human developers to compromising AI coding agents and automated workflows. Reporting cited the spread of the hallucinated npm package react-codeshift across 237 repositories, continued downloads of a malicious package named unused-imports, and a newer HalluSquatting technique that combines hallucinated resources with prompt injection to steer AI-assisted development tools into fetching and executing attacker-controlled code.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
In July 2026, researchers described "HalluSquatting," a technique that combines hallucinated resources with prompt injection to hijack AI coding agents into executing attacker-controlled code.
In 2026, the malicious package named "unused-imports" was still receiving downloads, showing that attackers were successfully weaponizing hallucinated package names.
In 2026, the hallucinated npm package name "react-codeshift" was found propagated across 237 repositories, indicating the threat had expanded from human developers to AI coding agents.
In 2025, a USENIX study reported that 19.7% of packages recommended by the tested code-generation models did not exist, providing quantitative evidence that slopsquatting had become a measurable threat.
In 2023, Bar Lanyado demonstrated the slopsquatting concept using the nonexistent package name "huggingface-cli," showing how hallucinated dependency names could create a software supply-chain risk.
An academic paper titled "We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs" was published on arXiv, documenting package hallucination behavior in code-generating models.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are exploiting AI-generated dependency hallucinations by registering malicious packages under names that coding assistants and autonomous agents invent, a technique known as **slopsquatting** or **hallusquatting**. The threat has progressed from a 2023 proof of concept around the nonexistent package `huggingface-cli` to broader evidence that AI tools repeatedly recommend packages that do not exist; a 2025 academic measurement found **19.7%** of AI-suggested Python and JavaScript packages were nonexistent, with many hallucinated names recurring across prompts and models. The risk escalated in 2026 as hallucinated package names began propagating through agentic development workflows and automated installs. Researchers reported the fake npm package name `react-codeshift` spreading across **237 repositories**, while the malicious package `unused-imports` continued to be installed, showing how model output can become a software supply-chain infection path. A July 2026 **HalluSquatting** variant further combined hallucinated resources with prompt injection to drive AI coding agents toward **remote code execution (RCE)**, expanding the attack surface from human typo-based dependency mistakes to model-generated and agent-executed compromise.
Jul 22, 2026
Researchers disclosed **HalluSquatting**, a prompt-injection technique that abuses AI coding assistants' tendency to hallucinate package, repository, plugin, or registry names and then retrieve them automatically. By predicting the fake identifiers a model is likely to invent, attackers can register those names on services such as GitHub or plugin stores, seed them with malicious instructions or payloads, and induce the assistant to execute attacker-controlled code. The researchers reported highly repeatable hallucinations—reaching up to **85%** for repository requests and **100%** for some skill-install scenarios—and said the method can deliver reverse shells and other malware without relying on software exploits, worms, or stolen credentials. The attack was reported to affect tools including **Cursor**, **Cursor CLI**, **Gemini CLI**, **Windsurf**, **GitHub Copilot**, **Cline**, **OpenClaw**, **ZeroClaw**, and **NanoClaw**, many of which can fetch third-party resources and run with elevated command-line privileges. Researchers from **Tel Aviv University**, **Technion**, and **Intuit** said they disclosed the issue to vendors while withholding full reproduction details, warning that the technique could enable large-scale device compromise, botnet assembly, and DDoS activity across mixed environments. Recommended defenses include forcing assistants to search and verify resources before fetching them, validating package and repository names, disabling unattended auto-run behavior, and having platforms reserve likely hallucinated identifiers.
Jul 15, 2026
ENISA published a March 2026 technical advisory on the **secure use of package managers**, warning that modern development workflows (e.g., *npm*, *pip*, *Maven*) can pull in far more code than developers expect due to direct and transitive dependency resolution. The advisory highlights how applications inherit large dependency graphs—often including unused modules—that still introduce vulnerabilities, maintenance and provenance risk, and expanded trust assumptions across the software supply chain. ENISA recommends secure practices for selecting, integrating, monitoring, and remediating vulnerable third-party dependencies as part of the SDLC. Separately, security researchers and industry commentary describe **slopsquatting**, a supply-chain technique that exploits AI coding assistants’ tendency to hallucinate plausible-but-nonexistent package names. Attackers can register those “phantom” names in public repositories and publish packages that appear to match the expected functionality while embedding malicious payloads, turning AI-generated suggestions into a predictable package-name acquisition strategy. The risk is positioned as distinct from typosquatting (human error) and is framed as requiring additional detection approaches beyond traditional controls, including more behavioral and validation-focused checks before adopting AI-suggested dependencies.
Jul 12, 2026