AI Hallucinations Spur Package Risks

Enterprise developers are facing a persistent security challenge known as slopsquatting, a phenomenon where AI coding assistants hallucinate non-existent software libraries. If developers follow these AI-generated suggestions, they inadvertently open the door for attackers to register those fake names and distribute malicious payloads through legitimate software supply chains.

Consistent Hallucinations Across Models

The predictability of these errors is particularly concerning. Research conducted by Aleksandr Churilov revealed that five major LLMs independently generated the exact same 127 nonexistent package names. This high level of correlation suggests that the models are not merely making random errors, but are instead following shared logic or training biases that lead to identical output across disparate systems.

The study, titled The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort, highlights that this behavior is present in current high-profile models, including Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2. Because these tools are widely integrated into development environments, the risk of developers unknowingly adopting hallucinated references remains a significant concern for code security professionals.

The Mechanics of Fake Libraries

The research attributes this conformity to two primary factors. First, models may be consuming identical, incorrect references embedded within public tutorials and technical documentation during their training process. Second, the AI might be extrapolating naming conventions common to specific ecosystems like PyPI or npm, allowing them to construct names that appear syntactically correct even though the packages do not exist.

• 127 total hallucinated package names identified across five models
• 53 of these names remain available for registration as of April
• 41 of the available names are on the PyPI repository
• 12 of the available names are on the npm registry

Assessing Current Exposure

Despite the potential for abuse, there is no immediate evidence of a widespread campaign exploiting these specific hallucinations. While the existence of these 53 unclaimed names creates an obvious target for threat actors, the research has not yet uncovered any instances where these names have been registered for malicious purposes or deployed in active attacks.

Implications for Secure Development

For organizations relying on AI-assisted coding, this trend suggests that the threshold for verifying external dependencies must be raised. If AI models can be coaxed into recommending identical, non-existent packages, attackers could potentially use this to predict which fake libraries to register. Security teams should consider implementing stricter dependency validation processes that automatically cross-reference AI-suggested imports against live registry indices before allowing them into the build pipeline.