Five Major AI Coding Tools Keep Inventing the Same Fake Software Packages

Key points

• Researcher Aleksandr Churilov identified 127 identical fake software package names hallucinated by five leading AI coding assistants.
• The five tools tested were Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2.
• As of April 2025, 53 of those fake names remain unclaimed on PyPI and npm, two of the most widely used software repositories on the internet.
• No evidence exists yet that criminals have registered any of the 53 remaining names, but the window is open.
• The attack method, called slopsquatting, has no confirmed victims named in this study.

What is slopsquatting, and why should non-developers care?

Slopsquatting is an attack where criminals plant malicious software packages, bundles of code that developers drop into their applications, at addresses AI tools are already directing developers toward. When a coding assistant invents the name of a package that doesn't exist, a criminal can register that name and fill it with harmful code. Any developer who follows the advice then unknowingly installs malware directly into a product real customers use.

If that product is a banking app, a hospital records system, or a retail checkout tool, the malicious code travels straight to the people who depend on those services. We first covered this attack pattern on 8 July 2026, when researchers showed how attackers could predict the fake names AI assistants produce and publish malware under them in advance.

What did the research actually find?

Churilov's paper, titled The Range Shrinks, the Threat Remains, isn't yet peer-reviewed, meaning it hasn't passed independent academic verification. Its core finding is still striking: five competing AI systems, built by different companies in different countries, kept inventing the same 127 package names that don't exist.

Two explanations emerge. All five tools likely trained on overlapping public material, such as developer tutorials and documentation containing errors or outdated references. Each model may also have independently guessed plausible-sounding names by following real software naming conventions, then arrived at the same guesses.

The study's immediate alarm is that any of those 53 open slots could be claimed at any moment, for free, with no technical skill required beyond creating an account. What's genuinely worrying isn't the 53 names themselves: it's that five independent systems converge so reliably on the same wrong answers, making the list of risky names predictable and consistent.

Should developers and their employers act now?

Yes, carefully. No attack using these specific names has been confirmed, which is the one piece of good news here. But the structural problem is real.

Developers who use AI assistants to suggest or write code should verify every package name against the official repository before installing anything. Security teams should consider automated checks that flag any newly installed package for review, particularly one suggested by an AI tool.

Ordinary users of apps built by developers can't act directly on this research. Keep apps updated, since vendors can patch out malicious dependencies once discovered, and report anything unexpected in an app's behaviour to the provider.

Common questions

Does this mean AI coding tools are dangerous to use?

Not inherently, but they require verification. AI assistants are useful, and they make mistakes that human developers must catch before those mistakes become security problems.

How would I know if an app I use was affected?

You likely wouldn't know immediately. Vendors are responsible for auditing their own code. App stores and software distributors sometimes scan for known malicious packages, but those checks aren't foolproof.