The Package Your Agent Hallucinated Now Exists — and It's Malicious

Every security team has a mental model of typosquatting: an attacker registers requets and waits for someone to fat-finger requests. It works, but it's a scattershot bet on human clumsiness. Slopsquatting is worse, because the "typo" isn't random. Language models invent plausible-but-nonexistent package names in predictable, repeatable patterns — and attackers can query the same models you use, harvest the names they invent, and register exactly those packages on PyPI and npm. The hallucination becomes a preorder. Your coding agent, running with autonomous install rights, is the customer who picks it up.

This isn't hypothetical. The largest study of the phenomenon generated 2.23 million code samples across sixteen models and found that 19.7 percent of recommended packages didn't exist — 205,474 unique fabricated names. And when a security researcher registered one of the most commonly hallucinated Python packages as a harmless empty shell, it was downloaded more than 30,000 times in three months and ended up in the install instructions of a major tech company's open-source repository. The supply chain attack that vibe coding made possible is already running its proof of concept.

Hallucinations Cluster, Which Makes Them Targetable

The intuition that saves most people from worrying about this is: hallucinations are random noise, so an attacker can't predict them. That intuition is wrong, and the data is unambiguous.

In the USENIX Security study from researchers at the University of Texas at San Antonio, when a prompt that triggered a hallucination was re-run ten times, 43 percent of the hallucinated package names appeared in every single run. Fifty-eight percent recurred more than once. These aren't cosmic-ray bit flips; they're stable attractors in the model's probability distribution. A model that believes starlette-reverse-proxy should exist will keep believing it across sessions, across users, and often across model versions — because the belief comes from the same place its real knowledge does: morpheme composition over training data. The name sounds right. It follows the ecosystem's naming conventions. It's exactly what the package would be called if someone had written it.

That stability changes the economics completely. An attacker doesn't need to guess what your developers will mistype. They run the popular models against common prompts — "set up a FastAPI reverse proxy," "parse this vendor's log format" — collect the phantom dependencies that recur, and register them. The candidate list is enumerable, the harvesting is automatable, and the registration is free. Commercial models hallucinate less (around 5 percent of package recommendations) than open-source models (around 22 percent), but "less" is doing no security work when the outputs cluster this tightly.

The empty-package experiment showed the demand side is real too. The researcher who registered the hallucinated huggingface-cli name did nothing to promote it. Tens of thousands of downloads arrived anyway, funneled by every model instance that kept hallucinating the same name — including into the README of Alibaba's GraphTranslator project, where humans copy-pasted the install command without checking that the package was what they thought it was. Now imagine the package hadn't been empty.

The Agent Turns a Bad Suggestion into an Executed Compromise

For the copilot era, package hallucination was an annoyance with a built-in circuit breaker: the human ran the install, saw ERR! 404 Not Found, muttered, and went looking for the real package. The hallucination failed loudly, before any code ran.

Agents remove the circuit breaker in both directions. First, an agent with shell access doesn't just suggest pip install fastapi-jwt-middleware — it runs it, inside a loop optimizing for a green build, without the flicker of hesitation a human feels at an unfamiliar name. Second, and less obviously, the agent removes the loud failure. If the package doesn't exist, the agent reads the 404, adjusts, and tries something else; nobody learns that the model wanted a phantom. But if an attacker has registered the phantom, the install succeeds — the agent gets its green checkmark, the task completes, and the malicious dependency rides into the repository inside a perfectly normal-looking commit.

Install-time code execution makes this immediate. npm lifecycle scripts and Python build hooks run arbitrary code the moment the package lands, before the agent has "used" it, before any test executes, before any review happens. And the agent's execution environment is a rich target: it typically holds ambient credentials — cloud keys, registry tokens, the developer's SSH agent — because we gave the agent our permissions so it could do our work. A compromised install inside an agent sandbox that isn't actually a sandbox is a credential-exfiltration event, not a code-quality event.

Recent measurements of agentic coding tools show the frontier improving but not closing. Advanced CLI agents that verify their work — running installs, reading errors, consulting documentation mid-task — cut hallucinated dependencies roughly in half compared to raw model output, and setups that validate names against a live registry index in real time do better still. But every configuration tested still produced edge-case failures, typically on complex prompts requesting several dependencies at once. Halving an attack surface that regenerates on every task is mitigation, not elimination. The model's tendency to compose plausible names is not a bug that patches out; it's the same mechanism that lets it write code at all.

Why "Review the Diff" Doesn't Catch It

The standard answer to agent risk is human review of agent output. For slopsquatting, that review fails structurally, not because reviewers are lazy.

Consider what the reviewer actually sees. A 400-line pull request that implements the feature, passes CI, and includes one new line in package.json:

Loading…