AI-suggested packages that don't exist (slopsquatting)

Steps

1. Before installing any package an AI suggested, look it up on the registry (npmjs.com or pypi.org). Check that it exists, who publishes it, when it was created, download counts and the linked source repo.
2. Be suspicious of very new packages, near-duplicate names of popular libraries, and packages with no repository or documentation.
3. Review your package.json or requirements file for dependencies you don't recognize, and remove ones your code doesn't use.
4. Commit your lockfile and install with npm ci (or the equivalent) in builds, so dependencies don't silently change between deploys.
5. Turn on automated dependency alerts (for example GitHub Dependabot) and run npm audit or pip-audit regularly.
6. Use scoped package names for any private packages so a public package with the same name can't be swapped in.

Why it matters

Researchers studying 16 code-generating LLMs across 576,000 code samples reported that the average share of hallucinated packages was at least 5.2% for commercial models and 21.7% for open-source models, with 205,474 unique hallucinated package names (Spracklen et al., USENIX Security 2025). npm's own threat guide describes typosquatting and dependency confusion, where attackers publish look-alike or same-name packages to trick people into installing them.

Sources

Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (arXiv) — https://arxiv.org/abs/2406.10279

USENIX Security 2025 presentation page — https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen

npm Docs: Threats and Mitigations — https://docs.npmjs.com/threats-and-mitigations

Related patterns

• Outdated packages with known vulnerabilities
• API secret keys shipped in your frontend bundle
• Prompt injection in your app's AI chatbot or AI features