Slopsquatting and AI package hallucinations: are controls keeping up?

TL;DR: AI models are now hallucinating package names with enough consistency to turn slopsquatting from a nuisance into a scalable supply chain attack, with 19.7% of recommended packages in a USENIX study found not to exist and 43% recurring on every identical prompt run, according to Xygeni. The real governance gap is that human review cannot protect workflows where agents can install dependencies before anyone verifies origin or intent.

NHIMG editorial — based on content published by Xygeni: slopsquatting evolution, AI package hallucinations, and agentic install risk

By the numbers:

• The study found that 19.7% of recommended packages did not exist.
• Open-source models hallucinated packages far more often, averaging 21.7% versus 5.2% for commercial models.
• When identical prompts were repeated ten times, 43% of hallucinated names appeared on every run.

Questions worth separating out

Q: What breaks when AI assistants recommend packages that do not exist?

A: The trust model breaks because existence in a registry is no longer a reliable proxy for legitimacy.

Q: Why do hallucinated package names create a bigger risk for autonomous agents than for developers?

A: Autonomous agents remove the human checkpoint between suggestion and execution.

Q: How should AppSec teams measure whether slopsquatting controls are working?

A: Measure how many AI-generated dependency suggestions are blocked before install, how many recurring hallucinated names are detected across repositories, and how quickly new fake package names are added to guardrails.

Practitioner guidance

• Block AI-suggested dependencies by policy Require package origin verification and central approval for any dependency first seen in an AI-generated suggestion, especially where the name does not exist in approved registries or maintainers lists.
• Detect recurring hallucinated package names Log dependency names proposed by assistants and agents, then compare them across repositories so repeated hallucinations can be denied before they spread through templates and shared prompts.
• Constrain autonomous install permissions Separate package recommendation from package execution so agents can propose dependencies but cannot install them without policy checks, provenance validation, or human approval.

What's in the full article

Xygeni's full article covers the operational detail this post intentionally leaves for the source:

• The step-by-step slopsquatting timeline from 2023 to 2026, including the named cases that show how the pattern changed.
• The research details behind the USENIX study, including model-by-model hallucination behaviour and recurrence patterns.
• The defensive logic behind Xygeni Shield's install-time blocking approach and how it fits into a developer workflow.
• The article's examples of agent-driven installs and prompt-injection chaining that move the threat from suggestion to execution.

👉 Read Xygeni's analysis of slopsquatting evolution and AI package hallucinations →

Slopsquatting and AI package hallucinations: are controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →