Slopsquatting frames LLM hallucinated packages a supply‑chain attack vector

Slopsquatting reframes LLM hallucinations as a supply chain attack surface rather than a quality problem, according to a recent ReHack analysis. The technique works because hallucinated package names are statistically predictable outputs, not random errors. That predictability is the property attackers exploit, because any name a model generates at scale can be registered and filled with malicious code before developers ever install it.

The attack differs from traditional typosquatting in one structural way. Typosquats live at the edges of human input: misspelled domains, transposed characters, lookalike strings. Registries and security tools have spent decades building defenses against that pattern. Hallucinated package names sit further from any real library. The source's example is illustrative: an attacker publishing "crossenv" to squat on the popular "cross-env" package is a pattern registries can flag. The same registry has no signal that "cross-env-extended" or "mpn install cross-env file" is suspicious, because those names do not pattern-match against a known library. The hallucinated name does not need to look like a typo. It just needs to be plausible enough that a developer reading the AI's recommendation does not pause to verify.

That plausibility threshold is the actual vulnerability. The source reports hallucination rates ranging from 50% to 82% depending on model and prompting approach, with GPT-4o at the low end near 23% even with prompt-based mitigation. The implication is not that any single hallucination is dangerous, but that the volume of hallucinations across a developer population is large and the names are not random: the same model tends to recommend the same fictitious package across sessions, which means an attacker can mine model outputs once and then register the high-confidence names. A register-once, harvest-many pattern is the operational shape of the attack.

The largest gap in the research sits between proprietary and open-source models. One study cited in the source ran 30 tests across 30 systems, producing 576,000 code samples and 2.23 million package recommendations, of which 19.7% were hallucinations. GPT-4.0 Turbo hallucinated packages at a 3.59% rate; the best-performing open-source model, DeepSeek 1B, reached 13.63%. Proprietary systems were reported as roughly four times less likely to generate hallucinated packages. For organizations standardizing on open-source coding assistants, that gap translates directly into a larger pool of registerable names and a larger attack surface, assuming attackers mine outputs from the same models the development team uses.

The verification burden does not disappear in the proprietary case. A 3.59% rate still represents thousands of fictitious package names over a production workload, and the source does not test whether proprietary models are more resistant to adversarial manipulation designed to surface hallucinated names. The proprietary safety case rests on the model's own filtering and on the fact that fewer hallucinated names exist per query, not on any demonstrated immunity to targeted extraction. Teams paying for proprietary models are buying a smaller surface, not a closed one.

The downstream effect on supply chain health is harder to bound. The source cites a separate analysis of 31,267 vulnerabilities across 14,675 packages in 10 programming languages, reporting a 98% annual increase in vulnerability discovery against a 25% annual increase in package count, plus an 85% increase in the average lifespan of unfixed vulnerabilities. That trend exists independent of AI-assisted development, but it sets the prior for how long a slopsquatted package can sit undetected in production. The source's claim that malicious packages could remain in production for months or years is consistent with the lifespan data, though the source does not specifically document a slopsquatting incident with that duration.

The attack surface scales with how much AI-generated code teams commit. The source reports that developers using AI tools estimate over 40% of their committed code already includes AI assistance, with daily usage reported by 72% of those who have tried AI tools. The verification cost is paid on every dependency the model recommends, and the source's recommendation of automated registry checks is the closest the analysis comes to a control layer, with no description of tooling that intercepts hallucinated names at the model output stage. Slopsquatting is the predictable cost of treating model output as trusted source material. The source frames the threat but does not establish which mitigation actually closes the gap at scale.