VV-012highSupply chain2025
Slopsquatting: AI suggests packages that don’t exist
A USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names.
What it is
The study found 205,474 unique non-existent package names. Commercial models averaged about 5.2%, open-source models 21.7%; JavaScript (21.3%) was worse than Python (15.8%). The paper names Cursor among widely used coding tools.
How to check
- Before installing, confirm each new dependency exists, has history, downloads and a real repo.
How to fix
- Pin dependencies with a lockfile, review new packages in PRs, and avoid installing names you have never heard of.
# Inspect a package before installing it
npm view <package-name> name version time.created repository.url
npm install --save-exact <package-name>Sources
More advisories for this tool
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalUpGuard: 16,326 Supabase databases had readable tables
- highCVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- highCVE-2026-103435: Claude Code could be raced into writing files outside the project