AI mistakes · Hallucination · costly
Coding assistants keep inventing package names — and attackers register them
Ask for code, get an import of a library that doesn't exist. Run npm install anyway, and you may fetch the malware someone published under that exact name.
multiple (class-wide) · any coding assistant
The setup
The everyday loop of AI-assisted coding: generate code, install whatever it imports, run it — measured across millions of generated samples.
What happened
Security researchers testing code-generation models found that a meaningful share of generated programs import packages that have never existed — with one 2025 study across 576,000 samples putting hallucinated dependencies near 20% for some open models. The names are plausible by construction, and crucially, they repeat: ask similar questions, get the same phantom package.
That repetition turns a quirk into an attack: register the hallucinated name on npm or PyPI, fill it with malware, and wait for developers — or autonomous agents with install permissions — to fetch it. Researchers named the technique 'slopsquatting', the AI-era cousin of typosquatting, and demonstrated working proof-of-concept attacks.
The failure needs no attacker to hurt, either: agents that install-and-run in a loop burn sessions chasing import errors for libraries that were never real.
Root cause
- Models emit statistically plausible package names, and plausibility is exactly what makes a fake name dangerous.
- Hallucinated names are stable across prompts, so attackers can predict and pre-register them.
- Install commands run with real credentials and network access on the strength of generated text alone.
- Nothing in the generate→install→run loop crosses a system boundary to ask 'does this package exist, and is it the famous one?'
The rule for next time
Before installing any dependency you generated or were told about, verify it against the registry: exact name, real download history, plausible maintainer. A package you can't verify is a package you don't install.
For the machines
{
"id": "hallucinated-package-install",
"failureMode": "hallucination",
"prevention": {
"rule": "Before installing any dependency you generated or were told about, verify it against the registry: exact name, real download history, plausible maintainer. A package you can't verify is a package you don't install.",
"checkBefore": [
"package-install",
"citation",
"external-content"
]
},
"machineNotes": "Check registry age + weekly downloads + repo link before install; treat new/zero-history packages matching a generated import as hostile by default. Pin versions and use lockfiles so a later squat can't slide in. The same verification applies to gems, crates, and actions."
}agents: GET /api/ai-mistakes/rules?check=package-install