Notifications
Clear all
Topic starter
02/08/2026 11:59 am
TL;DR: AI hallucinations are now producing package names that attackers can register and weaponise, turning developer trust in model-generated suggestions into a supply chain risk, according to Aikido. The governance gap is that autonomous or semi-autonomous installation workflows can turn a single hallucinated dependency into credential theft, hidden payload delivery, or broader NHI abuse.
NHIMG editorial — based on content published by Aikido: What is Slopsquatting? The AI Package Hallucination Attack Already Happening
By the numbers:
- In early 2024, huggingface-cli got more than 30,000 authentic downloads in three months after researchers proved the hallucinated package name could spread in the wild.
- As of early February, the malicious unused-imports package was still pulling 233 downloads a week.
Questions worth separating out
Q: What breaks when AI-generated package names are allowed to install without review?
A: The main failure is that model output becomes an execution path.
Q: Why do AI-generated package choices create more supply chain risk than normal developer workflows?
A: Because the agent can move from intent to execution without the human judgment step that usually filters suspicious packages.
Q: What do security teams get wrong about slopsquatting?
A: They focus on whether the package name looks plausible instead of whether the publisher is trusted.
Practitioner guidance
- Verify package publisher and namespace before installation Require maintainers, registration age, and namespace ownership checks for any package suggested by an LLM or coding agent.
- Restrict autonomous install privileges in agentic workflows Separate package installation rights from code generation rights, especially in CI and agent-assisted development.
- Scan nested dependencies and install-time hooks Use SCA tooling that inspects the full dependency tree, lifecycle scripts, and remote retrieval paths.
What's in the full article
Aikido's full article covers the operational detail this post intentionally leaves for the source:
- The specific npm examples and hallucinated package patterns that researchers observed in the wild
- The package-level detection and SafeChain workflow Aikido describes for intercepting installs before they run
- The developer-facing examples showing how AI suggestions turn into accidental dependency installs
- The practical context behind the real malicious packages and the downloads they continued to receive
👉 Read Aikido's analysis of slopsquatting and AI package hallucinations →
AI package hallucinations and slopsquatting: are your controls keeping up?
Explore further
02/08/2026 1:06 pm
Slopsquatting is a governance failure, not just a model error. The technical novelty matters less than the control failure it exposes. If AI can invent dependencies that developers then trust, the organisation has allowed model output to bypass package provenance checks. That makes dependency verification part of identity governance for build systems and agentic workflows. Practitioners should treat AI-suggested installs as an access decision, not a convenience feature.
A question worth separating out:
Q: How should teams govern AI agents that can install dependencies?
A: Treat dependency installation as a privileged action that requires scoped authority, logging, and explicit approval for new packages. The agent should not inherit broad secrets or unrestricted registry access just because it can generate code. If the workflow must install, do it in a constrained environment with secret minimisation and dependency review before merge.
👉 Read our full editorial: Slopsquatting is turning AI package hallucinations into real supply chain risk
