Slopsquatting is getting fresh attention in developer discussions this week, and it’s worth a proper look since it sits right alongside the skill-marketplace supply-chain story I covered last month — same underlying failure mode, different entry point.
The mechanism is simple to state precisely: a language model, asked to write code, suggests installing a package that sounds exactly right for the task — and doesn’t exist. An attacker who’s already studied what names models commonly invent registers that exact name on npm or PyPI ahead of time, and waits. A developer, or an autonomous coding agent running the install command without a human reading it first, pulls the attacker’s code straight into the build.
The scale, from the most-cited research behind this week’s renewed attention: across 2.23 million generated code samples, 19.7% — nearly one in five — contained at least one hallucinated package name, producing 205,474 unique fabricated names across the dataset. The part that actually makes this exploitable rather than just noisy: when researchers re-ran identical prompts ten times each, 43% of the hallucinated names came back on every single run, and 58% showed up more than once. That’s the opposite of random noise — it’s a predictable enough pattern that an attacker doesn’t need to guess what a model might hallucinate, they can just generate the same prompts themselves and register whatever comes back consistently.
Why agentic coding specifically raises the stakes past the traditional version of this risk: a human developer reviewing AI-suggested code at least provides an implicit checkpoint — a chance to notice an unfamiliar package name before running the install command. An autonomous agent that generates code, writes the install command, and executes it in the same loop removes that checkpoint by design. Security researcher Charlie Eriksen — the same researcher behind the skill-cloning attack I covered last month — separately traced a conflation-style hallucinated package propagating through 237 repositories via AI-generated agent skills specifically, the exact same entry point.
A real incident worth knowing, not just the abstract risk: the keyv npm compromise, which spread across roughly 444 packages and 779 advisories, included a second execution path that planted .claude and .vscode configuration set to fire the moment a developer or a coding agent opened the project — not just a malicious dependency sitting passively, but one engineered specifically to trigger through the exact tools this site covers. Separately, one hallucinated-name package was found still recording roughly 233 weekly downloads in February 2026, despite already being flagged and security-held by npm — a reminder that “caught by the registry” doesn’t mean “stopped reaching developers.”
What actually helps, in concrete, available terms: pin dependencies to exact, previously-verified versions rather than letting an agent freely resolve whatever name it generates; check a package’s existence and reasonable download history independently before letting an install command run unattended; and for anyone running agents with real autonomy over install steps, treat package installation as exactly the kind of consequential action I’ve written about requiring a human checkpoint — the same category as the other autonomous-execution risks covered repeatedly on this site this month, just arriving through a dependency name instead of a sandbox boundary or a cloned skill.
The uncomfortable throughline connecting this to everything else I’ve covered recently: hallucination isn’t just an accuracy problem that makes an agent occasionally wrong. It’s become a genuine attack surface, because a predictable enough mistake is something an adversary can plan around in advance — and a model doesn’t need to be compromised at all for that to work. It just needs to keep being wrong in the same specific, exploitable way.
