[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text admin_label=”Text” _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
In January 2026, security researcher Charlie Eriksen of Aikido Security<\/a> registered the react-codeshift package on npm\u2014a name he hadn\u2019t created and that had never been published before. This package was a figment of the imagination created by merging two real libraries, jscodeshift and react-codemod, and then spread to 237 GitHub repositories via instruction files (Agent Skills) generated by language models. After it was registered, automated agents began attempting to install it on a regular basis, demonstrating that a package name invented by AI could quickly make its way into real-world environments. <\/p>\n This episode illustrates “slopsquatting,” a supply chain attack in which a malicious actor registers nonexistent packages\u2014often suggested by AI tools\u2014in order to trick developers or IT staff into installing them.<\/p>\n A language model does not systematically check whether a dependency exists in a registry such as npm or PyPI before recommending it: it generates a probabilistic response and can thus produce a plausible but nonexistent package name. This error becomes particularly exploitable when it recurs. In their study<\/a>, Joseph Spracklen and his co-authors reran 500 prompts\u2014each of which had previously led to package hallucinations\u2014ten times: 43% of the invented names reappeared in every run, and 58% appeared at least twice. <\/p>\n This persistence means that an attacker does not need to guess a random name: they can probe a model, identify the fictitious dependencies that appear regularly, and then register them in a public registry before a developer or deployment agent attempts to install them.<\/p>\n The landmark study by Spracklen et al.<\/a>, presented at USENIX Security 2025, reveals some particularly striking figures. By analyzing 576,000 code samples generated by 16 models, the researchers found that nearly 20% of the recommended dependencies did not exist\u2014that is, more than 440,000 names out of 2.23 million. <\/p>\n The trend is even more pronounced in the open-source sector, with an average rate of 21.7 percent, compared with 5.2 percent for commercial models.<\/p>\n A replication published in 2026 by Aleksandr Churilov\u2019s<\/a> study, which examines several recent models (Claude, GPT, Gemini, DeepSeek), shows a relative improvement: the observed rates range from 4.62% to 6.10%. The gap between models has thus narrowed, but the problem remains significant. On a large scale, even a few percentage points represent a significant volume of fictitious dependencies. <\/p>\n The initial study also highlights another risk: confusion between ecosystems. Approximately 8.7% of the \u201challucinated\u201d Python packages actually correspond to existing packages on npm. In practice, a developer might be redirected to a dependency for another language or, worse, to a malicious package uploaded by an attacker under the same name. <\/p>\n A telling example, documented by Bar Lanyado (Lasso Security), illustrates the problem well: several language templates recommended installing a Python package named huggingface-cli<\/em>. Problem: this package did not exist. The official method actually relied on huggingface_hub<\/em>, which provides the CLI (now accessible via the command hf<\/em>).<\/p>\n To measure the actual impact of this error, the researcher released an empty package named huggingface-cli<\/em> on PyPI. The result: more than 30,000 downloads in three months, with no malicious content. His analysis then showed that this incorrect recommendation had been copied into the documentation for a public research project linked to Alibaba (GraphTranslator). In other words, an AI hallucination can end up in real code and be executed by developers. <\/p>\n A more recent case illustrates a worrying escalation. A malicious npm package named unused-imports<\/em>, suggested by algorithms in place of the legitimate package eslint-plugin-unused-imports, continued to be downloaded despite a security block, with approximately 233 weekly installations in early 2026 (Cloud Security Alliance). <\/p>\n This type of attack is part of a technique known as HalluSquatting<\/strong>. The concept: exploiting AI\u2019s predictable hallucinations to create booby-trapped packets or resources. In agent-based environments, the risk is even higher: an agent can retrieve these resources and execute malicious instructions, paving the way for compromises or even remote code execution. <\/p>\nAttack Mechanism: A Cybersecurity Risk That Exploits the Predictability of LLMs<\/h2>\n
Extent of the Problem and Hallucination Rates According to LLM Models (Claude, GPT, Gemini, DeepSeek)<\/h2>\n
Real-world cases and documented vulnerabilities: from malicious npm\/PyPI packages to HalluSquatting<\/h2>\n
Mitigating Slopsquatting: A Rigorous Chain of Trust, Not Blind Automation<\/h2>\n
\n