AI Coding Assistants Are Inventing Fake Software Packages, and Hackers Are Weaponizing Them

A New Kind of Trap, Built by the AI Itself

Since AI coding assistants became a standard part of software development, researchers have been tracking a new supply chain risk they call "slopsquatting," according to VentureBeat. The name mashes together "AI slop" and "typosquatting," the decades-old trick of registering misspelled domain names to catch careless typers. This one doesn't need a typo. It needs a hallucination.

When a developer asks an AI coding tool to write software, the model sometimes recommends installing a software package that sounds real but doesn't exist, according to VentureBeat. That's a known flaw of large language models: they generate plausible-sounding nonsense with total confidence. Normally that's just an annoyance. Someone notices the package doesn't exist, moves on.

But attackers have caught on. If they can figure out which fake package names AI tools tend to invent, they register those exact names on public code repositories and load them with malicious code, according to VentureBeat. Then they wait. A developer who trusts the AI's suggestion runs an install command, and malware lands directly in their codebase.

Why the Old Defenses Don't Work

Software registries have spent years building protections against typosquatting. If someone tries to publish a package called "crossenv" to impersonate the legitimate "cross-env" library, filters catch it, according to VentureBeat.

Those filters look for near-misses of real, popular package names. They're not built to catch a completely invented name like "cross-env-extended" that never existed in the first place and isn't mimicking anything specific. VentureBeat notes a registry wouldn't flag something like that as a threat, because there's no legitimate original to compare it against.

That's the real problem. This isn't attackers exploiting a typo. It's attackers exploiting the AI's confident invention of something that was never real to begin with. There's no existing rulebook for that.

The Scale of the Underlying Mess

A research team cited by VentureBeat analyzed 31,267 vulnerabilities across 14,675 software packages spanning ten programming languages. The findings aren't encouraging. Reported vulnerabilities are climbing at a 98% annual rate, according to the research, far outpacing the 25% annual growth in the number of open-source packages themselves. The average vulnerability is also sticking around 85% longer before getting fixed, per the same data.

That combination, more flaws showing up faster and taking longer to patch, means a malicious package planted under a hallucinated name could sit quietly in production environments for months or years before anyone notices, according to VentureBeat.

The Fair Counterpoint

Defenders of AI coding tools would argue this isn't really an AI problem, it's an old software-hygiene problem wearing a new mask. Developers have always been responsible for vetting their dependencies before installing them, whether a human or a chatbot suggested the package. Blaming the AI lets developers and companies off the hook for basic due diligence they should be doing anyway, like checking a package's download count, publish date, and maintainer history before trusting it with production code.

That argument has merit. No AI tool forces anyone to blindly run an install command. But it also sidesteps the scale problem. When a hallucinated package name gets suggested repeatedly across millions of AI-assisted coding sessions, one attacker registering that single name can compromise far more targets than old-school typosquatting ever could, precisely because the same fake name gets recommended over and over by the model.

What Comes Next

No major software registry has announced a specific technical fix aimed at hallucinated package names as of this writing. The responsibility, for now, sits squarely with development teams: verify every dependency before installing it, don't let an AI's confidence substitute for actual due diligence, and treat any package suggested by a coding assistant as unverified until proven otherwise.

The unresolved question is whether package registries like npm and PyPI will build detection systems specifically aimed at catching newly-registered packages that match known AI hallucination patterns, or whether this becomes another attack vector that companies quietly absorb into their existing security review processes without a formal industry response.