Socket: New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs

What it is

An independent, non-peer-reviewed arXiv preprint by Aleksandr Churilov ("The Range Shrinks, the Threat Remains") that re-ran the USENIX Security 2025 package-hallucination methodology against five 2026 frontier models, plus Socket's and PyPI Security's confirmation of which hallucinated names are actually registrable. The net result: 53 slopsquatting targets (41 PyPI, 12 npm) that all five models — Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, DeepSeek V3.2 — invented and that had no package, resolver, or security hold as of April 2026. Public npm examples named in the paper: css-color-stop, dns-sd, dom-ains.

How it works

An attacker registers one of the shared invented names and publishes malware under it, then waits for an AI coding tool to recommend it. Because every tested model produced the same names, a single malicious registration can hit users of Anthropic, OpenAI, Google, and DeepSeek at once. The paper offers two convergence explanations (shared incorrect references in public training material, or independent extrapolation from ecosystem conventions) but does not establish any training-data link between providers.

What to do

The operational lesson is a detection caveat, not a patch: a registry 404 does not mean a name is hallucinated. Socket's review found the four highest-volume npm "hallucinations" were valid Ember.js imports that resolve through ember-source, not standalone packages:

• @ember/service
• @ember/object
• @ember/routing
• @ember/controller

Two more were removed as false positives: ssh-keys (an existing package) and metro-evaluator (already a security-hold package). If you build slopsquatting detection off model output, resolve names through the relevant framework module system, not a bare registry lookup, or you will misclassify valid code. PyPI's existing prohibited-name list and normalization already blocked 68 of the 109 Python candidates — evidence that registry-side name reservation works.

Caveats

• These are potential targets, not an active attack; the study found no evidence any of the 53 names were maliciously registered or used.
• The preprint is not peer-reviewed.
• GPT-5.4-mini was tested at minimal reasoning effort and refused 32.14% of prompts; its hallucination rate was computed only from compliant, parseable responses and may not reflect the full prompt distribution.
• None of the five 2026 models beat the earlier cohort's best individual result (~3.6% for GPT-4 Turbo); the spread narrowed (16.5 → 1.48 percentage points) but hallucination did not go away.
• Python hallucinations exceeded JavaScript across all five models — a reversal from the 2025 study — so Python ecosystems warrant more attention here.