Slopsquatting explained

Updated Oct 22, 20263 min read

Sometimes your AI assistant suggests a package that doesn't exist. If someone registers that name first, the next npm install runs their code. This is called slopsquatting. Seth Larson of the Python Software Foundation coined the term for supply chain attacks built on AI package hallucinations.

How often AI makes up packages

A USENIX Security 2025 paper by Spracklen et al. tested 16 code models on 576,000 code samples. Of 2.23 million recommended packages, 440,445 (19.7%) didn't exist, which came to 205,474 unique fake names. Commercial models averaged 5.2% and open-source models 21.7%. JavaScript code had more fake packages than Python (21.3% vs 15.8%).

How a slopsquatting attack works

npm runs a package's preinstall and postinstall scripts by default, so the code doesn't even need to be imported. The attacker's package can read your .env or your SSH keys during install.

It already happened

In late 2023, Bar Lanyado of Lasso Security noticed AI models kept recommending huggingface-cli as a pip package. The real tool is installed with pip install -U "huggingface_hub[cli]". He uploaded an empty package under the fake name. It got more than 30,000 real downloads in three months, and an install line for it showed up in the README of an Alibaba research repo. His package was harmless. An attacker's wouldn't have to be.

Slopsquatting vs typosquatting

Signs of a made-up package

• The name isn't on npm or PyPI at all (the install fails, and your AI suggests a "fix").
• It exists but was first published days or weeks ago.
• It has almost no downloads, no linked repo, or a name that's one letter off a famous package.
• Your AI is confident, but the package's docs don't mention the function it told you to call.

How to check a package before you install it

1. Look it up

   Open the package on npmjs.com or pypi.org before installing. Check its age, author, weekly downloads and source repo.

2. Pin and lock

   Pin versions and commit your lockfile, so a new release can't slip in.

3. Ask for the source

   Ask your AI to name the official package and link its repo, then open that link yourself.

List every dependency in package.json and requirements.txt. For each one, tell me
the official registry page and source repo. Flag anything you can't verify, anything
first published in the last 30 days, and anything one letter off a popular package.

How Leakcade checks this

We read your manifests as text and look up each name on npm and PyPI (only those two hosts, nothing is installed). Names that don't exist are flagged high; packages younger than 30 days are flagged medium.

Further reading

1. Spracklen et al., USENIX Security 2025 (PDF)
2. Lasso Security: AI package hallucinations
3. The Register: AI bots hallucinate software packages

FAQ