Research reveals that slopsquatting remains a threat to developers using AI to aid coding.

The burgeoning reliance on Artificial Intelligence (AI) for software development, while promising unprecedented gains in efficiency and speed, has inadvertently opened a new and insidious cybersecurity vulnerability known as "slopsquatting." Recent research highlights that enterprise software developers continue to be at risk from this novel attack vector, where AI coding tools, in their quest to assist programmers, can "hallucinate" the existence of non-existent software libraries. Malicious actors, keenly observing these AI-generated suggestions, can then create and publish packages with these fabricated names, strategically positioning them to be inadvertently incorporated into legitimate applications by unsuspecting developers.

A significant study conducted by researcher Aleksandr Churilov has shed crucial light on the nature and prevalence of these AI-driven hallucinations. Churilov’s findings, detailed in his pre-peer-review research paper titled "The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort," reveal a striking consistency in the fabricated library names generated by leading AI coding assistants. Across five prominent Large Language Models (LLMs) – Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2 – Churilov identified an identical set of 127 non-existent package names that these tools hallucinated. This uniformity is a cause for concern, suggesting a common underlying mechanism or shared data sources contributing to these errors.

The implications of this research are far-reaching for the software development ecosystem. As of April 2026, a substantial portion of these hallucinated package names, specifically 53 of them, remained available for registration across major software repositories. Of these, 41 were identified on the Python Package Index (PyPI), a primary repository for Python libraries, and 12 were found on the Node Package Manager (npm), a similarly critical registry for JavaScript. The availability of these names presents a clear and present danger, as it provides a ready-made opportunity for malicious actors to exploit the AI’s erroneous suggestions.

The Genesis of AI Hallucinations in Code Generation

Churilov’s research posits two primary explanations for the observed conformity in LLM output regarding package hallucinations. The first suggests that these models may be inadvertently learning the same incorrect package references from shared public training materials. This could include a wide array of sources such as online tutorials, outdated documentation, or forum discussions where erroneous library names were previously referenced and subsequently ingested by the AI during its training phase. When multiple LLMs are trained on similar datasets, it is plausible they would converge on the same factual errors.

The second hypothesis points to the models’ independent capacity to extrapolate plausible package names based on established ecosystem conventions. LLMs are designed to understand patterns and predict likely outcomes. In the context of software development, they can infer what a library name "should" look like based on common naming structures and practices within specific programming languages and their associated repositories. This independent extrapolation, while often beneficial for generating sensible code, can also lead to the creation of names that appear legitimate and contextually appropriate to a developer, even if no corresponding package actually exists. This is akin to a human confidently recalling a piece of information that sounds right but is factually incorrect.

Slopsquatting: A Novel Cyber Threat Emerges

Slopsquatting, as defined by the research, is a relatively nascent form of malware attack. Its modus operandi is intrinsically linked to the aforementioned AI hallucinations. The process begins with an AI coding tool recommending a non-existent library to a developer. This recommendation might stem from a misunderstanding of the project’s requirements, a gap in the AI’s knowledge base, or simply an error in its predictive algorithm. Upon receiving this suggestion, the developer, trusting the AI’s assistance, might attempt to integrate this "library" into their codebase.

Observing these AI-generated suggestions, threat actors can proactively register packages with these exact hallucinated names on public repositories like PyPI or npm. When a developer, guided by the AI, attempts to install or import this non-existent library, they inadvertently download and execute the malicious package instead. This malicious package can then perform a range of harmful actions, from stealing sensitive data and credentials to installing ransomware, creating backdoors for future access, or even disrupting the entire software supply chain. The insidious nature of slopsquatting lies in its ability to bypass traditional security measures that might flag known malicious package names, as these are entirely novel creations designed to mimic legitimate, albeit nonexistent, software components.

The Scale of the Problem: A Snapshot of Vulnerability

The sheer number of hallucinated package names and their continued availability for registration underscore the immediate threat. With 127 shared fake names across multiple leading LLMs, the potential attack surface is significant. The fact that over a third of these names (53) were still open for registration in April 2026 is particularly alarming. This indicates a lag between the identification of the vulnerability and the proactive mitigation efforts, whether by the AI providers, the repository maintainers, or the security community.

The distribution across PyPI and npm also highlights the cross-platform nature of this threat. Developers working with Python and JavaScript, two of the most widely adopted programming languages in enterprise environments, are directly exposed. This means that applications built using these languages, which form the backbone of countless business operations, could be compromised through this sophisticated supply chain attack.

Relief Amidst the Concern: No Evidence of Malicious Exploitation (Yet)

While Churilov’s research paints a concerning picture, there is a glimmer of relief. As of the study’s reporting, there was no concrete evidence indicating that any of the 53 remaining available hallucinated package names had been maliciously registered or actively used in an attack. This suggests that the window of opportunity for exploitation, while open, may not have been fully leveraged by threat actors yet.

However, this lack of current evidence should not be interpreted as a sign of safety. The nature of cybersecurity threats is dynamic; what is absent today can be a prevalent attack vector tomorrow. The proactive identification of these vulnerable package names by Churilov’s research provides a critical opportunity for the cybersecurity community to preemptively secure these namespaces. This could involve domain registration, security researchers actively monitoring these names for malicious registration, or the LLM providers implementing more robust checks to prevent the generation of such erroneous suggestions.

Expert Reactions and Potential Mitigation Strategies

While direct quotes from all parties involved are not yet available, the implications of Churilov’s findings are likely to resonate strongly within the cybersecurity and AI development communities. Chief Information Security Officers (CISOs) and security-conscious developers are undoubtedly scrutinizing their development workflows and the AI tools they employ.

Potential mitigation strategies are likely to be multi-pronged:

• AI Model Improvements: LLM providers are expected to invest in refining their training data, improving their hallucination detection mechanisms, and implementing stricter validation processes before suggesting library names. This could involve real-time checks against known package repositories.
• Repository Security: Package repository maintainers like PyPI and npm may enhance their automated checks for suspicious package registrations, particularly those that closely mirror AI-generated suggestions or exhibit patterns associated with known hallucinated names.
• Developer Education: Increased awareness campaigns and training for developers on the risks of AI hallucinations and the importance of verifying suggested dependencies are crucial. Developers should be encouraged to cross-reference AI suggestions with official documentation and trusted sources.
• Dependency Scanning Tools: The security industry will likely develop or enhance dependency scanning tools to specifically identify and flag potential slopsquatting risks, perhaps by cross-referencing AI output patterns with repository data.
• "Namespace Reservation" Strategies: Companies and security organizations might proactively reserve namespaces that are frequently hallucinated by AI tools, thereby preventing malicious actors from claiming them.

Broader Impact and the Evolving AI Landscape

The slopsquatting threat is a stark reminder that as AI becomes more integrated into critical workflows, its vulnerabilities become critical security concerns. The "AI frontier" mentioned in Churilov’s paper signifies an era where AI models are increasingly sophisticated but still subject to emergent flaws. This research underscores the need for a continuous, rigorous evaluation of AI systems, not just for their performance but also for their security implications.

The broader impact extends beyond individual developer workstations. A successful slopsquatting attack could have cascading effects, compromising entire software supply chains. For enterprises that rely heavily on AI-assisted coding, this could lead to significant financial losses, reputational damage, and severe operational disruptions. The trust placed in AI tools, when misplaced, can have profound consequences.

As AI continues its rapid evolution, the cybersecurity landscape will undoubtedly continue to shift. The slopsquatting phenomenon is likely just one of many novel threats that will emerge as humans and machines collaborate more closely in the creation of software. Proactive research, vigilant monitoring, and robust collaborative efforts between AI developers, cybersecurity professionals, and platform maintainers will be paramount in navigating this evolving frontier and safeguarding the integrity of digital infrastructure. The findings from Churilov’s research serve as an urgent call to action, urging the industry to address this emerging threat before it escalates into widespread exploitation.