Five Major AI Coding Tools Keep Inventing the Same Fake Software Packages

Key points

• Researcher Aleksandr Churilov identified 127 identical fake software package names hallucinated by five leading AI coding assistants.
• The five tools tested were Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5-mini, Gemini 2.5 Pro, and DeepSeek V3.2.
• As of April 2025, 53 of those fake names remain unclaimed on PyPI and npm, two of the internet's most widely used software repositories.
• No evidence exists yet that criminals have registered any of the 53 remaining names, but the window is open.
• The attack method, called slopsquatting, is still an emerging threat with no confirmed victims named in this study.

What is slopsquatting, and why should non-developers care?

Slopsquatting is a type of attack where criminals plant malicious software packages, bundles of code that developers drop into their applications, at addresses that AI tools are already directing developers toward. When an AI coding assistant invents the name of a package that does not exist, a criminal can register that name and fill it with harmful code. Any developer who follows the AI's advice then unknowingly installs malware, meaning software designed to cause damage or steal data, directly into a product that real customers use.

If that product is a banking app, a hospital records system, or a retail checkout tool, the malicious code travels straight to the people who depend on those services.

What did the research actually find?

Churikov's paper, titled The Range Shrinks, the Threat Remains, is not yet peer-reviewed, meaning it has not passed independent academic verification. Even so, its core finding is striking: five competing AI systems, built by different companies in different countries, kept inventing the same 127 package names that do not exist.

Two explanations emerge from the study. First, all five tools likely trained on overlapping public material, such as developer tutorials and documentation that contained errors or outdated references. Second, each model may have independently guessed plausible-sounding names by following the naming conventions of real software ecosystems, and arrived at the same guesses.

As first reported by CSO Online, the study's immediate alarm is that any of those 53 open slots could be claimed by criminals at any moment, for free, with no technical skill required beyond creating an account.

Should developers and their employers act now?

Yes, carefully. No attack using these specific names has been confirmed yet, which is the one piece of genuinely good news here. But the study shows the underlying problem is structural: competing AI tools converge on the same wrong answers, which means the list of risky names is predictable and consistent.

Developers who use AI assistants to suggest or write code should verify every package name against the official repository before installing anything. Security teams should consider adding automated checks that flag any newly installed package for review, particularly one suggested by an AI tool.

Ordinary users of apps and services built by developers cannot act directly on this research. What they can do is keep apps updated, since vendors can patch out malicious dependencies once discovered, and report anything unexpected in an app's behaviour to the provider.

Common questions

Does this mean AI coding tools are dangerous to use?

Not inherently, but they require verification. AI assistants are useful, and they make mistakes that human developers must catch before those mistakes become security problems.

How would I know if an app I use was affected?

You likely would not know immediately. Vendors are responsible for auditing their own code. App stores and software distributors sometimes scan for known malicious packages, but those checks are not foolproof.