AI Coding Assistants Are Being Tricked Into Downloading Fake Packages
Slopsquatting, phantom domains and HalluSquatting all abuse the same weakness: coding bots that invent package names attackers then register.
Key points
- Three attack names, slopsquatting, phantom domains and HalluSquatting, all exploit the same flaw: AI coding assistants inventing package or domain names that do not exist.
- Attackers register the invented names, then wait for developers to run the AI-generated code and pull in the malicious version.
- Security firm ActiveState says pre-fetch verification, checking a package is real and trusted before it downloads, is the practical defence.
- The risk sits in the software supply chain, so malicious code can reach production without any human ever typing the package name.
- No specific rule or filing governs this yet, but it maps directly onto existing secure-development guidance from CISA and NIST SP 800-218.
A new family of attacks is quietly exploiting the same habit in every popular AI coding assistant: making things up.
When an AI tool writes code, it sometimes references a software library that does not exist. The name sounds plausible. The syntax is correct. The package is fiction. Researchers call these hallucinations, and attackers have worked out how to turn them into a delivery channel for malware.
The pattern has picked up three names in the industry, first surfaced in reporting by BleepingComputer: slopsquatting, phantom domains and HalluSquatting. They differ in target, package registries, code repositories, web domains, but the mechanism is identical. An attacker watches for names the AI tends to invent, registers those names first, and puts malicious code behind them. When the next developer runs the AI's suggestion, the package downloads and executes.
How does the attack actually work?
The attack works because installation happens after the AI writes the code, not before. A developer asks an assistant to build a feature. The assistant produces working-looking code that imports, say, react-safe-parser. That library was never real, but by the time the developer runs npm install, an attacker has registered it. The install pulls down the attacker's code and runs it with the developer's permissions.
This is what security engineers mean by a late-binding attack: the trust decision (is this package safe?) is deferred until the moment of download, and no one is checking.
Who is at risk?
Any organisation letting developers use AI coding assistants without a review step between suggestion and install. That covers a large share of software teams in 2025. The risk is highest where AI-generated code runs automatically in build pipelines, because no human ever reads the import line.
End users of the resulting software are exposed downstream. If a malicious package lands in a banking app or a hospital scheduling tool, the compromise travels with the update.
What can be done about it?
ActiveState, which sells dependency management tooling, argues the fix is pre-fetch verification: checking every package against a governed list of known-good sources before it is allowed to download. That means the build system refuses unknown names outright, rather than trusting the AI's word.
That approach lines up with existing secure-development guidance. NIST's Secure Software Development Framework, published as SP 800-218, already calls for verifying the integrity and provenance of third-party components under practice PW.4. CISA's Secure by Design principles say much the same. Neither document was written with AI hallucinations in mind, but both cover the underlying control.
| Attack name | What the AI invents | Where the attacker registers it |
|---|---|---|
| Slopsquatting | A software package name | Public package registries (npm, PyPI) |
| Phantom domains | A web address in generated code | Domain name registrars |
| HalluSquatting | A code repository reference | GitHub or similar hosts |
There is no dedicated regulation targeting this class of attack. It sits inside the broader software supply chain security debate that produced the 2021 US executive order on cybersecurity and the ongoing EU Cyber Resilience Act, which enters application in stages through 2027.
Common questions
Should I stop using AI coding assistants?
No. The problem is not the assistant, it is trusting its output without verification. Teams that pin their dependencies to an approved list are largely protected.
Does this affect software I already use?
Possibly, if that software was built with unreviewed AI-generated code. Ask your vendors whether they verify package provenance in their build pipeline.
