Ask a coding assistant to solve a problem and it will sometimes recommend installing a package: real ones for common tasks, and, measurably often, packages that do not exist at all. It invented a plausible name because the surrounding code pattern called for a dependency there. If you or your coding agent runs the install command anyway, whatever is actually registered under that name on PyPI or npm is what lands on your machine. Security researcher Seth Larson, developer-in-residence at the Python Software Foundation, named the resulting attack “slopsquatting”, registering the names models hallucinate, the AI-generated equivalent of typosquatting.
How often this actually happens
A team from the University of Texas at San Antonio, Virginia Tech and the University of Oklahoma measured it directly: “We Have a Package for You!”, accepted to USENIX Security 2025. Across 576,000 generated code samples from 16 popular models in two languages, they found hallucinated packages in “at least 5.2 percent for commercial models and 21.7 percent for open-source models,” totaling 205,474 unique hallucinated package names. This is not a rare edge case; for some open-source models it is roughly one in five suggested dependencies.
| Model class | Hallucination rate (of package recommendations) |
|---|---|
| Commercial models (average) | at least 5.2 percent |
| Open-source models (average) | at least 21.7 percent |
Why this is squattable, not just wrong
A one-off invented name would be a nuisance, not an attack surface. What makes it exploitable is repetition: as The Register reported on 12 April 2025, when researchers reran the same prompt ten times, “43 percent of hallucinated packages being repeated every time and 39 percent never reappearing.” Close to half of hallucinated names are not random noise; they are the same guess the model reaches for reliably given similar code. An attacker does not need to guess what a specific developer will type. They can run the same models against common prompts, collect the names that repeat, and register those on the real package index, in advance.
pip install fast-json-normalizer # suggested by a coding assistant
Collecting fast-json-normalizer
Downloading fast-json-normalizer-0.3.1.tar.gz
Running setup.py install for fast-json-normalizer ... done
# Nothing here indicates whether this name was ever a real, reviewed project
# or was registered specifically because models keep suggesting it.Why this fits the pattern OWASP already tracks
This is a variant of what OWASP’s Top 10 for LLM Applications calls a supply-chain risk for AI-assisted development: the trust boundary that used to sit at “did a human choose to add this dependency” moves to “did a model’s pattern-completion choose it,” and pattern completion has no concept of whether a name is real.
What to actually do about it
- Treat every package name a coding agent suggests as a suggestion to verify, not a known-good dependency, the same way you would treat a name a junior contributor typed from memory.
- Check registration date and download history before installing anything unfamiliar; a package that appeared recently and is suspiciously well-matched to a common AI-generated prompt pattern deserves a second look.
- Pin dependencies and use a lockfile, so a hallucinated name that slipped in once does not silently get re-resolved later.
- Watch what a freshly installed package actually does on first run. A newly registered dependency reaching out to a server it has no business contacting is a signal a firewall can catch even when a code review missed the name.
How FireAI and HisnLabs fit in
A squatted package that phones home still has to make a connection to do it, from a Python or Node process you just ran; FireAI shows you that connection, the process behind it and where it is going, before you decide whether it belongs there.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.