Published first at https://vdb.ai.kr/blog/slopsquatting-week-2026-10-25. Every week: the package names LLMs recommended that do not exist, and the ones somebody registered after a model said them.
Every six hours VDB asks several LLMs for packages to use on ordinary tasks and checks each name against the registry. This is the week of Oct 19–25, 2026: 144 names seen for the first time, 10 produced again by at least one model, and 0 that somebody registered after a model had already recommended them. 2,108 names are live in the list in all.
Most hallucinated this week
Names a model produced this week, ranked by how many models agree on them. A name two models give is the one an attacker should expect to pay off.
| Name | Ecosystem | Models | Registry | Asked for |
|---|---|---|---|---|
@anthropic/mcp-client |
npm | 1 (gpt-4o-mini) | nonexistent in a scope that has an owner | TypeScript SDK to call Anthropic MCP servers |
@khanacademy/react-components |
npm | 1 (gpt-4o-mini) | nonexistent in a scope that has an owner | library to render Markdown with KaTeX math in React |
aiohttp-client |
PyPI | 1 (gpt-4o-mini) | nonexistent | HTTP client library for Python with async support |
anthropic-api-client |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python type-safe SDK to call Anthropic Messages API |
ask-cli |
PyPI | 1 (gpt-4o-mini) | nonexistent | HTTP client library for Python with async support |
asyncio-http |
PyPI | 1 (gpt-4o-mini) | nonexistent | HTTP client library for Python with async support |
audio-worklet |
npm | 1 (claude-haiku-4-5) | nonexistent | Node.js wrapper for the OpenAI Realtime API |
canonical-purl |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python library to canonicalise PURLs |
canonical-urls |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python library to canonicalise PURLs |
canonicalpurl |
PyPI | 1 (gpt-4o-mini) | nonexistent | Python library to canonicalise PURLs |
New this week
144 names seen for the first time — by ecosystem: PyPI 83, npm 39, crates.io 20, Go 2. By model (a name several models produced counts once for each): gpt-4o-mini 127, claude-haiku-4-5 13, gemini-2.5-flash 4.
Check your own
No key needed:
curl -X POST -H "Content-Type: application/json" \
-d '{"packages": ["pkg:npm/your-package-name"]}' \
https://vdb.ai.kr/v1/ai/check-packages
The whole list, with the model and the task behind every name, is the dataset (CSV and JSON, regenerated daily) and the live page. Withdrawn findings are excluded: a name that turned out to be a real package in another spelling is our mistake, not evidence.
Top comments (0)