Your AI assistant will tell you to install a package that does not exist
Here is a small experiment you can run today. Ask your coding assistant to scaffold something slightly off the beaten path, a codemod for a framework migration, a helper for some niche file format, and watch the install commands it hands you. Some meaningful fraction of the time, it will tell you to npm install or pip install a package that has never existed. The name will look right. It will sound like something the community would have built. It just was not, until an attacker noticed the model keeps asking for it and published it themselves.
That attack has a name now: slopsquatting. The term was coined by Python security developer Seth Larson and picked up by Andrew Nesbitt, and it describes registering the package names that large language models hallucinate so that anyone following the model's advice installs your code instead. It is the supply-chain attack that the AI coding boom built for us, and the most interesting thing about it is that it is not theoretical anymore.
The package that almost was
The clearest demonstration comes from Charlie Eriksen at Aikido Security. He noticed an npm package called react-codeshift being referenced by AI agent skills, the little reusable instruction files people share to teach assistants how to do a task. Someone had written a skill back in October that told the agent to run react-codeshift for framework migrations. The package did not exist. The model had invented it, the skill had baked the invention in as gospel, and then other developers cloned and tweaked that skill, carrying the phantom dependency along with it.
Eriksen registered the real react-codeshift in January 2026 to see what would happen. He immediately started seeing downloads. By the time he wrote it up, the name had spread to 237 GitHub repositories, every one of them carrying an instruction to fetch a package that, until he claimed it, was pure fiction. His own summary is the line worth remembering: the supply chain just got a new link, made of LLM dreams. And the part that should make you sit up: the only reason it did not become an attack vector, he said, is because he got there first.
Sit with that for a second. A benign researcher won a race he did not know he was in, against any attacker who happened to run the same prompt and notice the same gap. There is no reason to think every such race ends with the good guy winning.
Why this is worse than typosquatting
We have lived with typosquatting for years. You meant to type react-dom, you typed raect-dom, and someone had parked malware on the slip. It is a real problem, but it depends on a human making a random mistake, and random mistakes are, well, random. They scatter. An attacker squatting typos is fishing across a wide, thin spread of fat-finger probabilities.
Slopsquatting is the opposite of random, and that is what makes it dangerous. When a model hallucinates a package name, it does not pick differently every time. Research into this, including the Importing Phantoms measurement study, found that hallucinated names are strongly repeatable: the same model given the same kind of prompt invents the same non-existent package over and over. That turns a random error into a predictable target. An attacker does not have to guess what you will mistype. They can run the popular models, write down the fake names that keep coming up, and register those, knowing the model will keep recommending them to thousands of people.
And the volume is not small. Studies of AI-generated code have found that roughly one in five suggested packages do not exist, with per-model hallucination rates reported anywhere from about 5 to 38 percent depending on the model and the prompt. Earlier work tracking real registries found that a meaningful share of hallucinated names eventually showed up as actual uploads. When a fifth of the dependency advice flowing out of these tools points at empty space, that empty space is a market, and someone will fill it.
The agent removes the moment you would have caught it
For a long time the saving grace was the human in the loop. A developer reading a suggestion to install some-package-i-have-never-heard-of would, at least sometimes, pause. Check the download count. Notice the repo was created last week and has one star. That pause is a real defense, and it is exactly what agentic workflows are designed to remove.
When you let an agent run commands for you, the install happens because a skill said so, three layers of automation deep, while you were looking at something else. The react-codeshift case is the template: the bad name lived inside a shared skill, the skill ran the install, and the install spread by people copying the skill rather than by anyone individually deciding to trust the package. The same property that makes agents useful, that they act without waiting for you, is the property that deletes the one human checkpoint where a fake package gets noticed. This is the same shape as the trust-prompt RCEs in coding agents I wrote about recently: the danger is not a clever exploit, it is automation executing a bad decision faster than a person could object.
What to actually do
The guidance from CISA, the NSA and their Five Eyes partners on AI-assisted development lands in roughly the same place, and it is the same place that sane dependency hygiene has always lived. The AI just raised the stakes.
- Do not let agents install dependencies without review. This is the single highest-value rule. If an assistant proposes adding a package, that proposal should land in front of a human before
npm installruns. Make it a hard gate in your agent config, not a habit you hope to remember. - Verify a package is real before you trust it. Real packages have history: download counts that predate this week, a maintained repository, releases going back more than a few days, dependents. A package the model loves but the world has never used is the exact profile of a slopsquat.
npm viewand a thirty-second look at the registry page catch most of it. - Pin and lock. Lockfiles and pinned versions mean a dependency cannot silently become something new, and they give you a single reviewable list of everything you actually pulled in. An SBOM at the project level makes the same thing legible across a team.
- Allow-list where it matters. For anything near production, restrict what agents and CI can fetch to a curated set of approved components and a trusted registry mirror. An agent that physically cannot reach arbitrary npm cannot install a phantom.
- Be most suspicious when the name is perfect. Attackers register the names the models hallucinate, and models hallucinate names that sound ideal for the task. A package called exactly what you wished existed, suggested confidently, with thin real-world history, is a flag, not a gift.
The mental model: a suggestion is a guess, not a citation
The reframe that makes all of this click is to stop treating a model's package recommendation as a reference and start treating it as a guess. When a human colleague tells you to use a library, there is a real memory of a real thing behind it. When a language model tells you, there is a probability distribution over plausible-sounding tokens, and plausible is not the same as real. Most of the time the guess happens to be correct because the popular packages are well represented in the training data. The failure mode is the long tail, the niche task where the right tool is obscure or does not exist, which is precisely where the model is most likely to confidently invent one and precisely where an attacker is most likely to be waiting.
This belongs to the same family as the other supply-chain stories piling up this season, the Red Hat npm compromise and the Codex token theft. The connective tissue is that a developer machine running AI tooling is now a high-value, lightly-guarded target, and the package manager is the door. Slopsquatting is the version where you do not even need to be tricked into the wrong package. You just need to trust the machine that is confidently wrong, at the exact moment no human is watching it type install.