AI Coding Tools Keep Inventing Fake Software Packages, and Registries Can't Catch the Malware Hidden Inside Them

The Gap in the Defense

Since the first reports on AI-hallucinated software packages surfaced July 11, security researchers have zeroed in on why this threat slips past every existing safeguard. According to VentureBeat, the attack has a name now: slopsquatting, a mashup of "AI slop" and "typosquatting."

Typosquatting is old news. Attackers register misspelled versions of popular package names, like "crossenv" instead of the legitimate "cross-env," and wait for developers to fat-finger an install command. Package registries have spent years building filters to catch exactly that pattern.

Slopsquatting doesn't look like a typo. It looks like a real package name, because an AI coding assistant invented it and it sounds plausible, according to VentureBeat. Think "cross-env-extended" or some other confident-sounding name an AI model generates when it hallucinates a library that doesn't exist.

Why Registries Can't Filter This

A typosquatting filter checks for near-misses of known package names. It has nothing to check against when the name isn't a misspelling of anything real, according to VentureBeat's reporting.

An AI coding assistant recommends a package that sounds legitimate but was never published. The danger starts when a hacker notices the same hallucinated name showing up across multiple AI tools, registers it on a public package registry, and stuffs it with malware.

The next developer who asks an AI assistant for coding help gets the same hallucinated recommendation. They install it. The malware is now inside their codebase, and according to VentureBeat, it can sit there undetected for months or years, quietly compromising every environment it touches.

The Numbers Behind the Trend

One research team examined 31,267 vulnerabilities across 14,675 software packages spanning 10 programming languages, according to VentureBeat. They found reported vulnerabilities climbing at a 98% annual rate, far outpacing the 25% annual growth in the total number of open-source packages being published.

The same research found the average lifespan of a vulnerability increased 85%. Bugs and malicious code are sitting in production systems longer before anyone catches them, a sign that detection isn't keeping pace with the volume of new packages flooding into open-source ecosystems.

None of that data proves how many of those vulnerabilities trace directly back to AI hallucinations specifically, and VentureBeat doesn't claim it does. But the trend line matters regardless of cause: vulnerabilities are piling up faster than the industry can find them, in an environment where AI-assisted coding is becoming the default way software gets written.

The Counterargument

Someone bullish on AI coding tools has a reasonable point here: hallucinated package names are not, by themselves, malicious. A model suggesting a library that doesn't exist is a quality problem, not a security breach. The breach only happens if a human attacker notices the pattern and acts on it.

That's a fair distinction. It also doesn't change the practical reality that developers copying AI-suggested install commands have no reliable way to tell a hallucinated package from a real one before running it. The burden of verification has shifted entirely onto the developer, and most are not checking every dependency by hand before it becomes what it was hired to do.

What Comes Next

No package registry, npm, PyPI, or otherwise, has announced a slopsquatting-specific filter as of this writing. Existing typosquatting defenses remain the primary line of protection, and VentureBeat's reporting makes clear those defenses were not designed for names that aren't misspellings.

The open question is whether registries or AI vendors move first. A registry could build a system flagging install requests for packages with zero download history and suspiciously recent publish dates. An AI vendor could build guardrails preventing coding assistants from recommending packages that don't verifiably exist in a registry at generation time. Neither fix has shipped yet, and until one does, the exposure described in VentureBeat's reporting stays open for any developer trusting an AI-generated install command without checking it first.