Hallucinated Packages: How AI Invents Dependencies Attackers Exploit | Blog | Endor Labs

What it is

An Endor Labs explainer on slopsquatting — attackers registering package names that AI coding assistants hallucinate — that goes beyond the headline statistics to give a mechanism breakdown and a concrete defensive workflow. The summary states the scale; this page states what to do about it and why standard defenses miss it.

How it works

LLMs predict plausible text without querying a live registry, so they emit names that fit naming patterns but were never published. The names are not random: a breakdown found ~38% resembled real packages, 13% were typos, and 51% were completely fabricated. Two properties make them exploitable — the same fake names recur across repeated prompts (giving an attacker a stable target to register), and open-source models hallucinate at a higher rate than commercial ones. It is a "pull" attack: the victim's own tooling installs the malicious package, and damage can begin at install time, not later in production.

Why standard checks fail

Spell-check and name-similarity detection miss slopsquatting because nobody mistyped anything — the name is a machine invention, not a fat-finger of a real package. This distinguishes it from typosquatting and dependency confusion. Detection must therefore rely on package behavior and provenance, not spelling.

What to do

The page prescribes layered controls, treating AI output and its dependencies as untrusted input:

• Verify before install — confirm the package actually exists; check maintainer history and download counts; pin versions with lockfiles.
• Review AI-generated code and imports — scrutinize every PR for new or unusual dependencies, and separate the person who prompted the AI from the person who approves the change.
• Prioritize by reachability — detection alone is noisy; use reachability to find which risks are actually exploitable.

The strongest control sits at the install step itself, blocking malware before an AI agent's npm/pip install completes (this is Endor Labs' own product pitch).

flowchart TD
    A[AI suggests dependency] --> B{Exists in registry?}
    B -->|No, unpublished| C[Hallucinated name]
    C --> D{Attacker registered it?}
    D -->|Yes| E[Malware pulled at install]
    D -->|No| F[Install fails / harmless]
    B -->|Yes| G[Verify provenance + reachability]

Caveats

The actionable metrics (19.7% hallucination rate; ~1 in 5 recommended versions safe; 49% carrying known vulnerabilities) are already in the summary. Much of the "what to do" section is framed as Endor Labs product capability rather than vendor-neutral guidance — the underlying principles (verify existence, pin lockfiles, split prompter from approver, prioritize by reachability) are actionable without their tooling. The page text is truncated mid-sentence in the final reachability section.