Your Agent Confidently Imports a Package That Doesn't Belong to Anyone You Trust

When a coding agent writes import or adds a line to requirements.txt, it's making a claim: this package exists and does what I think. Most of the time it's right. But LLMs hallucinate package names — confidently, and repeatably. A USENIX Security 2025 study ran 2.23 million code samples through 16 models and found 19.7% referenced a package that doesn't exist — 205,474 unique fabricated names. The dangerous part: 43% of those hallucinated names reappeared on every single re-run of the same prompt. They're not random. They're predictable.

Predictable is the whole attack. It's called slopsquatting: register the name the models keep inventing, and the next agent that confidently pip installs it runs your code. One squatted hallucination (huggingface-cli) pulled 30k+ downloads before anyone noticed it was fake.

We wanted to know how exposed that namespace already is. So we ran a deterministic check — no models, just registry lookups.

70% of the "obvious" hallucinations are already taken

The study found that 38% of hallucinations are "conflations" — the model mashes two real packages into one plausible name (express-mongoose, react-axios). That pattern is easy to reproduce: take a list of popular npm packages, generate the A-B mashups, and ask npm whether each one is registered.

We generated 90 such conflation names from the top npm packages and looked them up:

checked 90 conflation-pattern names
REGISTERED on npm: 63 (70%)
  of those, 22 have <50 downloads/month — obscure, near-zero-trust packages
  examples:
    express-zod          0 dl/mo   created 2022-12-29
    chalk-utils          0 dl/mo   created 2026-05-14
    next-helper          8 dl/mo   created 2025-12-09
    express-prisma       10 dl/mo  created 2025-08-27
    react-passport       16 dl/mo  created 2018-10-30

70% of the names an LLM would plausibly invent are already registered — and a big slice of them are obscure packages with single-digit or zero monthly downloads, some created within the last few weeks. To be clear and fair: most of these are benign — abandoned experiments, someone's weekend project. We're not claiming 63 live attacks. The point is structural: the exact namespace LLMs hallucinate into is densely occupied by near-zero-trust packages. When your agent emits chalk-utils and it resolves to something, "it installed fine" tells you nothing about whether it's the something you wanted. The squatters don't need to invent names — they just need to sit on the ones the models already favor.

slopcheck

You can't eyeball this. A hallucinated dependency looks exactly like a real one in a diff — it's a plausible name next to a version number. So we wrote slopcheck: point it at a manifest and it checks every dependency against the live registry for the smells of a hallucination.

$ slopcheck requirements.txt
slopcheck — 8 pypi dependencies

  ● HIGH requests-oauth-helper
         not in the pypi registry — hallucinated, a typo, or an unregistered (squattable) name
  ● HIGH pandas-helper-utils
         not in the pypi registry — hallucinated, a typo, or an unregistered (squattable) name
  ● HIGH reqests
         not in the pypi registry — ... did you mean 'requests'?

  ● 3 of 8 dependencies look risky (3 not in the registry at all).

That's a real run against a plausible AI-written requirements.txt. The checks are deliberately simple and deterministic:

• HIGH — not in the registry. The strongest signal. The package is hallucinated, mistyped, or an unregistered name sitting open for a squatter. Either way it shouldn't ship.
• WARN — one edit from a hugely popular package. reqests → requests, raect → react. We use a transposition-aware edit distance, so the common "fat-finger swap" counts as one edit, not two.
• WARN — exists but barely downloaded. A real package with 12 downloads a month is not the well-known library the agent thinks it is.
• INFO — no linked source repository. Thin provenance; worth a look.

It reads package.json or requirements.txt, takes raw names with --ecosystem, emits --json, and exits non-zero on a HIGH — so it drops into CI or a pre-commit hook. The whole thing is one dependency-free file, and the core is offline-testable (you can feed it canned registry metadata), so it's deterministic to verify.

A note on what it is and isn't: it's a supply-chain smell test, not a malware scanner. A clean slopcheck doesn't mean a dependency is safe; a HIGH doesn't mean it's malicious. What it does is convert "the agent said install this" into "a human should confirm this resolves to the project they expect" — which is exactly the step that's missing when an agent writes a dependency line and you accept the diff.

Why this matters now

The reason slopsquatting is a 2026 problem and not a 2019 one is the volume and the determinism. Agents write dependency lines at scale, the hallucinations repeat, and "it installed and the import resolved" is the only check most pipelines do. CSA, Mend, and Aikido have all flagged it as an active attack class. The defense isn't exotic — it's verify the name against the registry before you trust it, the same way you'd never paste a curl-to-bash without reading the URL. slopcheck just makes that automatic.

Run it on the last thing your agent built. If a HIGH comes back, you found a dependency that belongs to a stranger.

slopcheck is a single file, no dependencies. → Talk to us if you're hardening an AI-assisted build pipeline.

---

The hallucination rates and the 38%-conflation pattern are from the USENIX Security 2025 study (credited — we did not discover them). Our contribution is the deterministic occupancy measurement (the A-B conflation sweep is reproducible from the included script) and the manifest-level defensive check. Registry data fetched live 2026-06-20; "registered" ≠ "malicious" — most are benign, and that caveat is the honest framing.

---

Get the tool → slopcheck in agent-ops — open source (MIT), a single dependency-free script, part of our toolkit for running coding agents in production.