Advisory VV-012high2025
Slopsquatting: AI suggests packages that don’t exist
A USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names.
What it is
The study found 205,474 unique non-existent package names. Commercial models averaged about 5.2%, open-source models 21.7%; JavaScript (21.3%) was worse than Python (15.8%). The paper names Cursor among widely used coding tools.
How to check
- Before installing, confirm each new dependency exists, has history, downloads and a real repo.
How to fix
- Pin dependencies with a lockfile, review new packages in PRs, and avoid installing names you have never heard of.
# Inspect a package before installing it
npm view <package-name> name version time.created repository.url
npm install --save-exact <package-name>