The package your AI just told you to install? Someone beat you to registering it, and it’s not empty.
Here’s something that came out of USENIX Security 2025 that’s worth knowing if you use any AI assistant to write code: about 1 in 5 packages these tools suggest are complete fabrications. They just don’t exist.
The weird part isn’t that AI makes things up, we all know that happens. It’s that it makes up the same thing, consistently, across sessions and even across different models. That predictability is exactly what turned this into an attack.
People started watching for these repeat-offender fake names, claiming them on npm and PyPI before anyone else could, and quietly loading them with malicious code. The next time an AI suggests that name and someone runs the install, the trap is already set. This is being called slopsquatting.
Some context on how far this has gone:
<ul>
<li>One researcher’s test package, meant purely as a demonstration, ended up with 30,000+ real downloads in three months</li>
<li>There are already confirmed malicious packages riding this exact pattern in live registries</li>
<li>And with AI now responsible for a huge chunk of the code shipped daily, this keeps happening faster than most teams can react to it</li>
</ul>
If this is new to you (it was new to a lot of us too), we’re breaking it down in a free live session on July 22nd: how the attack actually works, and a practical way to catch a malicious package before any signature or blocklist even knows it exists.
📅 July 22nd | 10:30 CEST
👉 Register here: <a href="https://www.linkedin.com/events/7480522038990979074/" target="_blank" rel="noopener nofollow">https://www.linkedin.com/events/7480522038990979074/</a>
𝐘𝐨𝐮 𝐜𝐚𝐧’𝐭 𝐝𝐞𝐟𝐞𝐧𝐝 𝐰𝐡𝐚𝐭 𝐲𝐨𝐮 𝐜𝐚𝐧’𝐭 𝐬𝐞𝐞.

This squad was established to be able to share anything about development. Post, Comment, and Upvote!

Dev World

Slopsquatting is an emerging supply chain attack that exploits AI coding assistants' tendency to hallucinate package names. Roughly 1 in 5 packages suggested by AI tools don't exist, and crucially, these fabricated names are consistent across sessions and models. Attackers monitor for these recurring fake names, register them on npm and PyPI, and load them with malicious code. One demonstration package received 30,000+ real downloads in three months, and confirmed malicious packages using this pattern are already live in registries. The post promotes a free live session on July 22nd covering how the attack works and detection strategies.

Slopsquatting: when your AI's mistake becomes an attack.