Your AI Assistant Just Recommended a Package That Doesn't Exist

Go ahead, ask your favorite AI coding assistant for a package recommendation. There's a ~1 in 5 chance it just made one up.

That's not a joke stat. Researchers at USENIX Security 2025 ran 2 million code generations across 16 LLMs and found a 19.7% hallucination rate for recommended packages. And here's the part that should actually worry you: the same fake names came back again and again across repeated prompts.

That's not random noise. That's farmable.

Enter: slopsquatting 🎭

Attackers have caught on. The playbook is simple:

• Ask popular LLMs for package recommendations on common tasks, repeatedly
• Note which hallucinated names keep showing up
• Register those names on npm / PyPI / Maven, with malicious code inside
• Wait for a developer (or an agent) to pip install / npm i the name their AI just "recommended"

One test package planted as a proof-of-concept picked up 30,000+ downloads in three months. This isn't theoretical anymore, it's a live attack surface.

*The bigger problem: nobody's reviewing the install anymore
*
Here's the shift that actually changes the threat model: agentic coding tools don't just suggest packages, they install them. Mid-task. No pause. No human glancing at the name before it hits disk.

The entire "a developer reads the package name before installing" checkpoint, the thing supply chain security has quietly relied on for 15 years, just... isn't in the loop anymore.

Add to that:

• npm has had 3 major supply chain incidents in 8 months (Shai-Hulud, the axios compromise with nation-state malware, a near-identical worm via SAP packages)
• Roughly 40% of AI-generated code ships with a vulnerability
• Traditional SAST/SCA tools understand code, not whether a model, agent, or MCP server has been compromised

*So what actually catches this?
*
Two things need to happen, and they need to happen automatically, regardless of whether a human or an agent triggered the install:

**

• Registry-level detection
  ** — scanning newly published packages for malicious behavior, not waiting for a CVE/signature to exist. (This is what MEW does, and it's free in Xygeni's Developer tier if you want to poke at it.)
  **

• Install-time enforcement
  ** — checking policy at the OS level the moment an install is requested, before the package touches disk and before any install script runs. Attribution down to the exact PID/process, so it doesn't matter if it came from your terminal or an agent running in the background.

*Real talk: how are you handling this?
*
Genuinely curious what the dev.to community is doing here. Are you:

Pinning/vetting every dependency an agent suggests before it merges?
Running any kind of pre-signature malware detection?
Just... trusting it and hoping for the best? (No judgment, most teams are here.)

We're talking through this in person at OWASP AppSec Days Portugal and German OWASP Day (both Sept 23-24). If you're around either event, would love to compare notes!