Home / Blog

• slopsquatting
• ai-agents
• supply chain
• research

Slopsquatting: what it is, and why AI agents made an old attack work again

Typosquatting needed you to make a mistake. Slopsquatting only needs a model to be confident. The measured hallucination rates, the names attackers are actually waiting on, and what closes the gap.

DepWall · 2026-09-20 · 6 min read

Typosquatting has always had a ceiling. It needs a human to mistype, and humans mistype in predictable, low-frequency ways. You register expres, you wait, you catch the occasional slip.

Slopsquatting removes the typo. The developer types nothing wrong — a language model recommends a package that does not exist, and the attacker has already registered that name. The mistake is upstream of the keyboard, it is confident, and unlike a typo it is reproducible: the same model asked the same question tends to invent the same name.

The term was coined by Seth Larson, developer-in-residence at the Python Software Foundation. It is now documented as its own attack class, and there is enough published measurement to say how big it is.

How often models invent packages#

The foundational number comes from "We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs", presented at USENIX Security 2025 by researchers at UT San Antonio, the University of Oklahoma and Virginia Tech. They generated 2.23 million code samples across 16 models, in Python and JavaScript.

The shape of the hallucinations matters as much as the rate. They break down as 51% pure fabrications, 38% conflations — two real things mashed into one plausible name — and 13% typo variants. Only that last group overlaps with classic typosquatting. The other 87% is new namespace, and it is namespace an attacker can enumerate by running the models themselves.

One finding deserves separate billing: 8.7% of packages hallucinated for Python actually exist on npm. Cross-ecosystem name collision means a "safe" name in one registry can be a live package in another.

The rates improved. The attack did not go away.#

A 2026 follow-up, "The Range Shrinks, the Threat Remains" by independent researcher Aleksandr Churilov, re-ran the question against a frontier cohort — Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro and DeepSeek V3.2 — across roughly 200,000 responses. It is worth noting this one is posted to arXiv and has not been peer-reviewed.

Its finding: rates converged to a much tighter band of 4.62% to 6.10%. Better, clearly. But convergence has a sharp edge — 127 hallucinated names were shared across all five models, and after review by PyPI Security and Socket, 53 of them were still available for registration as of April 2026 (41 on PyPI, 12 on npm).

That is the number to sit with. Not the rate — the overlap. A name that five independent frontier models converge on is not noise. It is a queue, and it is public to anyone willing to run the same prompts.

It is not theoretical#

Three cases, all documented:

huggingface-cli. Researcher Bar Lanyado tested the premise by registering the hallucinated name and uploading an empty package. In three months it took over 30,000 downloads. Alibaba had copied an AI-recommended install command for it straight into public repository documentation without checking whether the package was real. The hallucination had been laundered into a citable source.

unused-imports. Models consistently suggest this instead of the real eslint-plugin-unused-imports. Somebody registered it. As of February 2026 it was still recording roughly 233 weekly downloads despite being security-held.

react-codeshift. Charlie Eriksen traced this one propagating through 237 repositories via AI-generated agent skills. This is the case that matters most, because no human was in it: autonomous agents hallucinated the package, generated the install command, and executed it. Nobody read the name.

Why agents make it structurally worse#

A developer who sees an unfamiliar package name has a moment of friction — a small, unreliable, but real pause. Three things remove that pause.

The agent installs without narrating. An agent resolving a build error runs npm install as one step inside a longer task. The name scrolls past inside a tool call, if it is shown at all.

Confident text is the output format. A model does not flag the difference between a package it has seen ten thousand times and one it has assembled from two plausible halves. Both arrive in the same declarative sentence.

The package then gets to talk back. Once installed, its README, description and manifest are text — and text, to an agent, is input. The thing that decides what happens next is now reading attacker-authored content. That is why we treat injection in package text as a separate detection from the name check: the name gets you the install, the text gets you the agent.

What actually closes it#

Verify the name against the project, not the registry. The registry confirming a name exists is the attack succeeding, not the check passing. Go to the project's own documentation.

Pin and lock. A lockfile means the resolution happened once, under review, rather than on every install on every machine.

Do not let install commands come from generated text unread. If an agent proposes an install, the package name is the one token that deserves a human glance — it is short, and it is the whole attack.

Gate installs at the shell, not in the prompt. An instruction telling an agent to be careful is a suggestion to a system that can be argued with. A check that runs when npm install is invoked is not.

Where the detection genuinely stands#

DepWall carries two signals here: hallucinated-name, an exact-match feed of documented hallucination targets, and slopsquat, which compares against a dictionary of popular names. Every entry in the feed carries a citation, and the tests enforce that the feed never intersects the popular-names list — a name that becomes legitimate gets removed, not kept.

The limit is worth stating plainly, because it is the same limit every tool in this category has. A curated feed covers names somebody has already documented. The 53 registrable names in that 2026 study are covered because they were published. The ones your particular model invents next week, for your particular stack, are not — until somebody reports them.

That is a real gap and there is no honest way to close it with a list. What narrows it is the second-order signals — a package days old, with no adoption, named like something established, arriving in an agent's install command — which is why the maturity signal exists and why the answer for an unknown package is ASK rather than a silent allow.