Can an AI's made-up code get me hacked?
Slopsquatting: when made-up names become a trap.
Package: a ready-made bundle of code someone else wrote, which you download and use in your own project. Like installing an app, but for code.
Packages live in public shops called registries. Python's is called PyPI and JavaScript's is called npm. Anyone can publish to them.
When an agent writes code for you, it often says "first, install this package".
AI writes package names the same way it writes everything else: by guessing what's likely (see "AI isn't looking anything up").
Most of the time the guess is a real package. Sometimes it's a name that sounds right but doesn't exist.
pip install fast-csv-cleaner
Plausible. Possibly made up.
Made-up example.
In 2025, researchers generated 576,000 code samples from 16 different AI models and checked every package they recommended.
Here's the clever part. 58% of the made-up names came up again when the same request was repeated.
So the fake names are predictable. An attacker can ask an AI the same questions, collect the names it invents, and publish real packages under those names, with harmful code inside.
Next time someone's agent "remembers" that package, it exists. And it installs.
Slopsquatting: registering package names that AIs tend to invent, so that people who follow the AI's advice install your code.
It's a mash-up of slop (low-quality AI output) and typosquatting (registering misspelt names like "gooogle.com" to catch people's typos). The term was coined by Seth Larson, a Python security developer.
If you use Claude Code or similar tools, you'll see approval prompts like "Run: pip install …".
That one click downloads and runs code from a stranger. It deserves the same care as opening an email attachment.
Check before you install. Ask: "Give me the link to this package's page on PyPI (or npm)." Then open it.
Look for signs of life. A real, widely used package has lots of downloads, a history going back years, and a project website. A brand-new one with no history is a warning sign.
Slow down on install prompts. If you didn't expect a new package, ask why it's needed before approving.