--- title: The fake npm package your AI just recommended? Someone... description: New USENIX Security 2025 research reveals ~19.7% of packages recommended by AI coding assistants are hallucinated, and attackers are exploiting this by... canonical: https://daily.dev/posts/the-fake-npm-package-your-ai-just-recommended-someone-already-weaponized-it--hjww0yh9w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The fake npm package your AI just recommended? Someone already weaponized it. | daily.dev og:description: New USENIX Security 2025 research reveals ~19.7% of packages recommended by AI coding assistants are hallucinated, and attackers are exploiting this by... og:url: https://daily.dev/posts/the-fake-npm-package-your-ai-just-recommended-someone-already-weaponized-it--hjww0yh9w og:image: https://api.daily.dev/og/posts/hJwW0yh9W.png og:image:alt: The fake npm package your AI just recommended? Someone already weaponized it. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The fake npm package your AI just recommended? Someone already weaponized it. **[Cyber News](https://daily.dev/sources/cybernews)** · [@julia7](https://daily.dev/julia7) · 1 min read · 0 upvotes · 0 comments ## Summary New USENIX Security 2025 research reveals ~19.7% of packages recommended by AI coding assistants are hallucinated, and attackers are exploiting this by registering those predictable fake package names on public registries and embedding malware. Dubbed 'slopsquatting,' the attack is already active: one proof-of-concept hallucinated package received 30,000+ downloads in three months, and over 450,000 malicious packages were published in 2025 alone — a 75% year-over-year increase. Signature-based scanning cannot keep pace with novel packages, pointing to a need for behavior-based detection approaches. ## Content **Nearly 1 in 5 AI-suggested packages don't exist. Attackers are already exploiting that.** New research (USENIX Security 2025) found that ~19.7% of packages recommended by AI coding assistants are pure hallucination. The concerning part isn't the hallucination itself; it's that the same fake package names come back predictably across sessions and models. Threat actors have caught on. They're registering those exact hallucinated names on public registries, shipping malware inside, and waiting for the next install. This attack now has a name: **slopsquatting**. Some data points worth flagging: - A single hallucinated package planted as a proof-of-concept drew **30,000+ downloads in three months** - Confirmed malicious variants are already live in public registries - **450,000+ new malicious packages** were published in 2025 alone, a ~75% YoY increase - Signature-based scanning structurally can't keep up with novel packages published hours or minutes ago We're covering this in a live session on July 22nd, breaking down how the attack works and how detection needs to shift from signature-based to behavior-based to catch it in time. If anyone wants to join, more than welcome ➡️ [https://www.linkedin.com/events/7480522038990979074/](https://www.linkedin.com/events/7480522038990979074/) 𝐘𝐨𝐮 𝐜𝐚𝐧'𝐭 𝐝𝐞𝐟𝐞𝐧𝐝 𝐰𝐡𝐚𝐭 𝐲𝐨𝐮 𝐜𝐚𝐧'𝐭 𝐬𝐞𝐞. ## Similar posts on daily.dev - [Slopsquatting: Your AI Invented a Package, and an Attacker Was Waiting](https://daily.dev/posts/slopsquatting-your-ai-invented-a-package-and-an-attacker-was-waiting-pz8bcrd9w) · DEV · 4 upvotes · 0 comments - [New Study Identifies 53 Slopsquatting Targets Across 5 Front...](https://daily.dev/posts/new-study-identifies-53-slopsquatting-targets-across-5-front--6t7a1jnzb) · Socket · 0 upvotes · 0 comments - [Supply-chain attacks take aim at your AI coding agents](https://daily.dev/posts/supply-chain-attacks-take-aim-at-your-ai-coding-agents-o8vsjrfrt) · CSO Online · 0 upvotes · 0 comments - [Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion](https://daily.dev/posts/who-vets-ai-s-code-the-scale-challenge-facing-open-source-ingestion-krgdfwrvv) · BleepingComputer · 0 upvotes · 0 comments - [Prevent AI Package Hallucination Attacks in CI/CD](https://daily.dev/posts/prevent-ai-package-hallucination-attacks-in-ci-cd-j6zbr4wkf) · SitePoint · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/the-fake-npm-package-your-ai-just-recommended-someone-already-weaponized-it--hjww0yh9w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/the-fake-npm-package-your-ai-just-recommended-someone-already-weaponized-it--hjww0yh9w","headline":"The fake npm package your AI just recommended? Someone already weaponized it.","text":"New USENIX Security 2025 research reveals ~19.7% of packages recommended by AI coding assistants are hallucinated, and attackers are exploiting this by registering those predictable fake package names on public registries and embedding malware. Dubbed 'slopsquatting,' the attack is already active: one proof-of-concept hallucinated package received 30,000+ downloads in three months, and over 450,000 malicious packages were published in 2025 alone — a 75% year-over-year increase. Signature-based scanning cannot keep pace with novel packages, pointing to a need for behavior-based detection approaches.","url":"https://daily.dev/posts/the-fake-npm-package-your-ai-just-recommended-someone-already-weaponized-it--hjww0yh9w","datePublished":"2026-07-08T09:47:14.453Z","dateModified":"2026-07-08T09:47:30.612Z","author":{"@type":"Person","name":"Julia","url":"https://daily.dev/julia7","image":"https://media.daily.dev/image/upload/s--Vye82kCe--/f_auto/v1752235114/avatars/avatar_JI6NHO2CHs2BU4FFm4NUw?_a=BAMClqZW0","description":"DevSecOps Lover and Software Supply Chain Security Advocate | Solutions Manager at Xygeni","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":260}},"image":"https://media.daily.dev/image/upload/s--C6Ymkkib--/f_auto/v1783501305/posts/RsKVdcjl0?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/cybernews","name":"Cyber News"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cyber News","item":"https://daily.dev/squads/cybernews"},{"@type":"ListItem","position":3,"name":"The fake npm package your AI just recommended? Someone already weaponized it."}]} ```