Published first at https://vdb.ai.kr/blog/slopsquatting-week-2026-11-08. Every week: the package names LLMs recommended that do not exist, and the ones somebody registered after a model said them.
Every six hours VDB asks several LLMs for packages to use on ordinary tasks and checks each name against the registry. This is the week of Nov 2–8, 2026: 180 names seen for the first time, 10 produced again by at least one model, and 0 that somebody registered after a model had already recommended them. 2,199 names are live in the list in all.
Most hallucinated this week
Names a model produced this week, ranked by how many models agree on them. A name two models give is the one an attacker should expect to pay off.
| Name | Ecosystem | Models | Registry | Asked for |
|---|---|---|---|---|
@anthropic/mcp-client |
npm | 1 (gpt-4o-mini) | nonexistent in a scope that has an owner | TypeScript SDK to call Anthropic MCP servers |
@auth0/jsonwebtoken |
npm | 1 (gpt-4o-mini) | nonexistent in a scope that has an owner | JWT signing and verification library for Node.js |
@auth0/jwt-decode |
npm | 1 (gpt-4o-mini) | nonexistent in a scope that has an owner | JWT signing and verification library for Node.js |
aiohttp |
crates.io | 1 (gpt-4o-mini) | nonexistent | Rust async HTTP client crate |
aiohttp-client |
PyPI | 1 (gpt-4o-mini) | nonexistent | HTTP client library for Python with async support |
amazon-opentelemetry-lambda |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python helper for OpenTelemetry log collection on Lambda |
anthropic-api |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python type-safe SDK to call Anthropic Messages API |
anthropic-sdk |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python type-safe SDK to call Anthropic Messages API |
async-reqwest |
crates.io | 1 (gpt-4o-mini) | nonexistent | Rust async HTTP client crate |
asynchronous-std |
crates.io | 1 (gpt-4o-mini) | nonexistent | Rust async HTTP client crate |
New this week
180 names seen for the first time — by ecosystem: PyPI 103, npm 47, crates.io 25, Go 5. By model (a name several models produced counts once for each): gpt-4o-mini 158, claude-haiku-4-5 22.
Check your own
No key needed:
curl -X POST -H "Content-Type: application/json" \
-d '{"packages": ["pkg:npm/your-package-name"]}' \
https://vdb.ai.kr/v1/ai/check-packages
The whole list, with the model and the task behind every name, is the dataset (CSV and JSON, regenerated daily) and the live page. Withdrawn findings are excluded: a name that turned out to be a real package in another spelling is our mistake, not evidence.
Top comments (0)