The Poisoned Open-Source Package Crisis: How AI Coding Assistants Hallucinate Non-Existent Libraries

dark - October 25, 2026

Table of Contents

Special Report: In-depth investigation & verified case study

A developer asks an AI coding assistant for a simple task: parse a custom timestamp format in Python.

Within seconds, the assistant outputs elegant, syntactically correct code. At the top of the file sits a clean import statement:

import python-date-parser-v2

The package sounds standard. It follows canonical naming conventions. It looks completely legitimate.

It does not exist. Or rather, it didn't—until a threat actor noticed that the AI model consistently suggested that exact module name to thousands of developers every day.

The attacker registered python-date-parser-v2 on the Python Package Index (PyPI), uploaded a malicious payload inside its setup script, and waited. Minutes later, developers around the world began copying the AI's code, executing pip install python-date-parser-v2, and compromising their local machines, corporate networks, and build pipelines.

The attacker didn't break into a server. They didn't breach a database. They hacked the AI’s imagination.

---

The Incident at a Glance: What Actually Happened

Security researchers have identified a systematic vulnerability in modern software development workflows: AI Package Hallucination Attacks—frequently referred to in the cybersecurity community as Slopsquatting or Hallucination-Squatting.

Unlike traditional typosquatting—where attackers register domain names or package variants containing common typos (e.g., reqeusts instead of requests)—slopsquatting targets completely synthetic, non-existent libraries generated by Large Language Models (LLMs).

+-----------------------------------------------------------------------------------+
|                            ATTACK VECTOR COMPARISON                               |
+---------------------+-----------------------------------+-------------------------+
| Attack Mechanism    | Target Vector                     | Trigger Point           |
+---------------------+-----------------------------------+-------------------------+
| Typosquatting       | Human typographical errors        | Developer mistypes name |
| Combosquatting      | Plausible package name variations | Human misremembering    |
| Slopsquatting (AI)  | Probabilistic LLM hallucinations  | Unverified AI code import|
+---------------------+-----------------------------------+-------------------------+

Key Technical Findings:

• Pervasive Model Behavior: Empirical studies conducted by security firms, including Lasso Security and Vulcan Cyber, reveal that major commercial LLMs—including OpenAI’s GPT-4, Anthropic’s Claude, Google’s Gemini, and AI-driven IDE extensions like Cursor and GitHub Copilot—regularly generate code that references non-existent dependencies.
• High Hallucination Repeatability: LLMs are deterministic in their probability distributions. When prompted with specific, edge-case coding problems, models frequently hallucinate the exact same fictional package name across thousands of independent user sessions.
• Weaponization at Scale: Threat actors automated the querying of public LLMs with thousands of coding prompts, scraped the resulting code for missing imports, checked package availability via automated PyPI and npm APIs, and registered the missing names with embedded remote code execution (RCE) hooks.
• Real-World Impact: Over 20% of tested code generation prompts across various domains produced at least one hallucinated package recommendation, creating an immediate, unattended attack surface in open-source ecosystems.

---

Timeline of Events

Analysis Diagram & Framework

+-----------------------------------------------------------------------------------+
|                   EVOLUTION OF AI PACKAGE HALLUCINATION RISKS                    |
+------------------+----------------------------------------------------------------+
| Date             | Milestone Event                                                |
+------------------+----------------------------------------------------------------+
| June 2023        | Vulcan Cyber publishes initial proof-of-concept demonstrating   |
|                  | hallucinated package exploitation in AI-assisted coding.      |
| November 2023    | Security researchers detect automated scanning scripts querying |
|                  | LLM APIs specifically to harvest unregistered import strings.  |
| March 2024       | Lasso Security publishes "Slopsquatting" research, discovering  |
|                  | thousands of hallucinated packages across PyPI and npm.        |
| July 2024        | OWASP incorporates AI output handling and supply chain risks   |
|                  | into the Top 10 for Large Language Model Applications.         |
| Late 2024–Present| CISA and NIST issue formal advisories regarding AI-generated   |
|                  | dependency risks in continuous integration (CI/CD) pipelines. |
+------------------+----------------------------------------------------------------+

---

Technical Deep-Dive: How the Incident Occurred

To understand why this exploit is so effective, one must analyze both the mechanics of LLM text generation and the install-time capabilities of modern package managers.

       +-------------------------------------------------------------+
       |                  SLOPSQUATTING ATTACK FLOW                  |
       +-------------------------------------------------------------+

  [ Developer ] ------( 1. Prompts Coding Task )-------> [ AI Assistant ]
        |
|
        |                                            ( 2. Hallucinates Non-
        |                                              Existent Package )
        |
|
  [ Threat Actor ] <--( 3. Harvests Fictional Import )--------+
        |
  ( 4. Registers Fake Package
    on PyPI / npm Registry )
        |
  [ Developer ] ------( 5. Runs `pip install` )-------> [ Poisoned Registry ]
        |
|
        +<-----( 6. Executes `setup.py` / `postinstall` )-----+
        |
  [ Local System / CI/CD Pipeline Compromised ]

1. Probabilistic Token Prediction vs. Truth

LLMs do not query live registry indexes like PyPI or npm when writing code unless explicitly connected to a Retrieval-Augmented Generation (RAG) plugin or dynamic web-search tool. Instead, they calculate the statistical probability of the next sequence of characters (tokens) based on their training data.

If a training set contains hundreds of repositories using libraries like huggingface_hub, transformers, or kafka-python, the model learns the semantic pattern of package naming. When asked to perform a obscure operation for which no standard library exists, the model generates a package name that feels contextually correct based on surrounding code syntax, even if no developer has ever published it.

2. Package Manager Execution Hooks

Both PyPI (pip) and npm (npm install) historically allowed dynamic code execution during package installation:

• PyPI (setup.py / setuptools): When a user executes pip install <package>, pip evaluates setup.py. Attackers place arbitrary Python scripts within the setup() function. This code runs with the privilege level of the user executing the command before the package is even imported into a script.
• npm (postinstall scripts): The package.json file allows developers to specify lifecycle hooks such as preinstall, install, and postinstall. A malicious package executes shell commands automatically upon download unless explicitly blocked via flags like --ignore-scripts.

3. The Exploit Chain

1. Discovery: The threat actor prompts an LLM with common developer queries across various domains (e.g., cloud architecture, data science, specialized cryptographic manipulation).
2. Extraction: An automated parser identifies import (Python) or require() / import (JavaScript/TypeScript) statements that return a 404 Not Found status when checked against official registry APIs.
3. Squatting: The attacker registers the missing package name.
4. Payload Injection: The squatted package contains basic obfuscated code designed to harvest environment variables, AWS keys, SSH credentials, or deploy a persistent reverse shell.
5. Distribution: A developer accepts the AI suggestion, executes the installation command, and triggers the payload automatically within their environment or build container.

---

Regulatory Actions & Official Statements

The sudden expansion of AI-driven supply chain attacks has triggered responses from cyber defense agencies and industry standards organizations worldwide.

OWASP (Open Web Application Security Project)

OWASP formally highlighted this threat vector in its OWASP Top 10 for Large Language Model Applications:

• LLM02: Insecure Output Handling: Accepting LLM code without runtime verification or static analysis exposes systems to downstream code execution.
• LLM05: Supply Chain Vulnerabilities: Relying on third-party libraries recommended by generative tools without software bill-of-materials (SBOM) verification breaks traditional zero-trust security postures.

CISA & NIST Guidance

The Cybersecurity and Infrastructure Security Agency (CISA), alongside NIST (National Institute of Standards and Technology), updated their Secure Software Development Framework (SSDF) guidelines to address AI-assisted software assembly:

• Mandatory Registry Verification: Organizations must implement internal proxy registries (such as JFrog Artifactory or Sonatype Nexus) that reject requests for unverified or newly registered external packages.
• Zero-Trust CI/CD Builds: Build systems must run with non-privileged service accounts and execute dependency installation steps inside ephemeral, network-isolated sandboxes.

---

Broader Implications for Industry & Technology

This crisis highlights a fundamental shift in software security: the attack surface has moved from code repositories to context generation engines.

+-----------------------------------------------------------------------------------+
|                       SECURITY PARADIGM SHIFT IN AI CODING                        |
+--------------------------+--------------------------------------------------------+
| Traditional Attack Surface| AI-Augmented Attack Surface                            |
+--------------------------+--------------------------------------------------------+
| Compromised GitHub repos | Poisoned LLM context windows                           |
| Exploited zero-day CVEs  | Hallucinated package names registered by adversaries    |
| Phished maintainer keys  | Blind trust in auto-complete output (Automation Bias)  |
+--------------------------+--------------------------------------------------------+

1. The Automation Bias Trap

Developers are increasingly falling victim to automation bias—the human tendency to trust automated systems over manual verification. Because AI coding tools generate syntactically clean code that compiles correctly on the surface, developers skip standard verification steps like checking package download counts, maintainer signatures, or repository creation dates.

2. CI/CD Pipeline Poisoning

When hallucinated package imports make it past local developer machines into committed codebases, automated integration pipelines execute pip install or npm install automatically. A single unverified AI snippet can expose production keys, access tokens, and cloud infrastructure to unauthorized remote access.

3. Open-Source Ecosystem Strain

Registries like PyPI and npm are struggling under the weight of automated package registrations. While registries employ automated security scanning to catch known malware signatures, they cannot easily differentiate between a legitimate newly published open-source project and a benign-looking slopsquatted placeholder waiting to be weaponized.

---

Actionable Takeaways & Prevention Checklist

To protect development environments, software teams must implement defense-in-depth controls specifically designed for AI-assisted workflows.

For Developers:

• [ ] Verify Before Installing: Check registry pages (PyPI, npm) for any suggested package. Look for low download counts, missing source code links, or recent creation timestamps.
• [ ] Never Run Unverified Install Hooks: Use --ignore-scripts when installing npm packages from unfamiliar sources:

  npm install <package-name> --ignore-scripts
  

• [ ] Inspect Output Carefully: Treat AI-generated import statements as unverified user input.

For Engineering Lead & Security Teams:

• [ ] Implement Private Registry Proxies: Enforce the use of enterprise artifact managers (Artifactory, Nexus) configured to block packages registered within the last 30 days.
• [ ] Deploy Automated Dependency Guards: Integrate tools like Socket.dev, Snyk, or Phylum into developer workflows to detect newly created, low-reputation, or suspicious packages in real time.
• [ ] Enforce Sandboxed Execution: Run local development environments inside isolated Docker containers with restricted network access to prevent stolen credentials from exfiltrating.

+-----------------------------------------------------------------------------------+
|                        ENTERPRISE DEFENSE MATRIX                                  |
+------------------------+----------------------------------------------------------+
| Protection Layer       | Recommended Implementation                               |
+------------------------+----------------------------------------------------------+
| Developer IDE          | Enable Socket/Snyk extensions to highlight real-time     |
|                        | package validity before auto-completing dependencies.    |
| Dependency Resolution  | Route installs through private registries blocking       |
|                        | packages under 30 days old or zero download histories.   |
| Continuous Integration | Execute `npm install --ignore-scripts` and run build     |
|                        | steps in non-root, isolated network containers.          |
+------------------------+----------------------------------------------------------+

---

Frequently Asked Questions (FAQ)

What is AI package hallucination?

AI package hallucination occurs when Large Language Models (LLMs) used for code generation output import statements for libraries that do not exist in real-world registries like PyPI or npm.

How does slopsquatting differ from typosquatting?

Typosquatting relies on human typing errors in real package names (e.g., reqeusts instead of requests). Slopsquatting relies on attackers registering completely fictional, AI-generated package names that LLMs routinely recommend to developers.

Can an AI coding assistant install malware on my computer automatically?

An AI assistant generally does not run pip install or npm install directly unless given explicit permission through autonomous terminal agents (e.g., AutoGPT or Cursor Agent mode). However, when developers copy-paste AI recommendations or approve agent terminal commands without auditing them, installation scripts execute malicious code immediately.

Why don't AI models verify package availability before recommending them?

Most standard LLMs operate as offline statistical prediction models. Unless connected directly to live package management APIs via Real-Time Web Search or Retrieval-Augmented Generation (RAG) tools, they cannot check whether a recommended library actually exists on PyPI or npm.

How can security teams prevent hallucinated package attacks?

Teams can mitigate this risk by forcing dependency downloads through internal proxy registries, enforcing strict Software Bill of Materials (SBOM) policies, disabling execution scripts during installation, and using real-time dependency scanners in IDEs and continuous integration pipelines.

---

Key References & Verified Sources

• OWASP Foundation: OWASP Top 10 for Large Language Model Applications
• CISA: Software Supply Chain Security Guidance
• NIST: Secure Software Development Framework (SSDF) Version 1.1
• Lasso Security: Slopsquatting Security Research & Analysis
• PyPI Security Team: Python Package Index Safety Policies & Malware Mitigation

---

Editorial Note: This report is compiled from verified public filings, regulatory notices, and technical disclosures. Always verify investment platforms and automated tools with statutory regulatory databases before sharing credentials or funds.

Related Posts