# What is slopsquatting? How to stop AI-invented package names > Slopsquatting is registering malware under package names that AI coding tools invent. How often models invent names, and how to refuse them at install time. Source: https://chain305.com/slopsquatting/ --- # What is slopsquatting? AI coding tools invent package names. Attackers register them. How often models invent package names, why coding agents make it worse, and how to refuse a slopsquatted package before it installs. By [Muhammad Zeeshan Sultan](https://chain305.com/about/#founder), founder of Chain305 · October 2026 Questions and answers ## What is slopsquatting? Slopsquatting is a supply-chain attack in which an attacker registers a package under a name that AI coding assistants invent. A model suggests `pip install` or `npm install` for a package that does not exist; an attacker notices the same invented name coming up again and again, publishes malware under the name, and waits for the next developer or coding agent to install the package. Slopsquatting is typosquatting without the typo. The developer types the name exactly as suggested, and the name is wrong because the model made the name up. The supply of invented names is large: in a USENIX Security 2025 study, 19.7% of the packages recommended by 16 code-generating models did not exist. ## How often do AI models invent package names? Often enough to be worth attacking. In “We Have a Package for You!” (Spracklen et al., USENIX Security 2025), researchers generated 576,000 code samples with 16 code-generating models and found: - **19.7%** of the packages the models recommended did not exist. - **205,474** unique invented package names. - Open-source models invented names far more often than commercial ones. Newer models invent fewer names, but a rate of a few per cent across millions of daily suggestions is still a steady supply of names to register. ## Why do coding agents make it worse? Coding agents make slopsquatting worse because an agent installs packages without a person reading the command. A developer might pause at an unfamiliar name in a suggestion. By contrast, an agent running in a terminal through Claude Code or Cursor installs whatever package the agent decided on. Every install an agent runs is an install with no human review, so an invented name goes from model output to `npm install` or `pip install` in one step. If an attacker has already registered the invented name, the malicious package’s install script runs on the developer’s machine or CI runner with the same access as the agent. The defence has to sit on the install itself, where a release hold, typosquat matching and a known-malicious feed can refuse the package before download. ## How do you stop slopsquatting? You cannot stop models inventing names, so the defence sits on the install: 1. **Hold brand-new packages and versions.** A slopsquatted package is new by definition. A release-age hold refuses anything published in the last day or two, which is usually long enough for a malicious package to be reported and removed. 2. **Check the name against the packages people actually use.** Many invented names are close variants of a real one: a hyphen instead of an underscore, words in a different order, a plausible suffix. Typosquat matching catches those. 3. **Look at the package’s history.** A package with no repository, no release history and no downloads that suddenly shows up in your build deserves a refusal, not an install. 4. **Refuse known-malicious packages by name.** Once a slopsquatted package is reported, a malware feed refuses it everywhere at once. 5. **Give agents a way to check before they install.** An agent that can ask “is this package real and safe?” before it runs the install command avoids most of the problem. ## How does Chainsaw handle it? Chainsaw is a package firewall on the install path for npm, PyPI and 14 other ecosystems, and Chainsaw applies each of the defences above to every install, whether a person or an agent typed the command: - a default release hold on versions published in the last 48 hours, - typosquat detection with edit-distance, homoglyph and word-reorder matchers across fifteen ecosystems, - a trust score that includes whether the package’s repository exists and matches its owner, - a known-malicious feed that refuses reported packages by name, and - an [MCP server](https://chain305.com/for-agents/) that lets coding agents such as Claude Code and Cursor look a package up before installing it. Chainsaw does not know whether a name was invented by a model. Chainsaw refuses the install because the package is new, looks like a real one, or has no history, which is what a slopsquatted package looks like. For example, the first install of a package registered yesterday under a near-copy of a popular name meets both the 48-hour release hold and the typosquat matchers. ## Is slopsquatting the same as typosquatting or dependency confusion? They are related attacks on the same moment, the install: - **Typosquatting** relies on a person mistyping a real name. - **Slopsquatting** relies on a model inventing a name. - **Dependency confusion** relies on a public package taking the place of your private one with the same name. Chainsaw reserves your internal names against the public registries for that. [More on what an install-path firewall catches.](https://chain305.com/what-is-a-package-firewall/) ## Sources - Spracklen et al., [We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs](https://arxiv.org/abs/2406.10279), USENIX Security 2025. Coding agents install without review ## Put a check between your agents and the registry Start a free org in monitor mode and see which installs Chainsaw would refuse, including the ones your agents run. [Start in monitor mode](https://chain305.com/chainsaw/signup) [Chainsaw for AI agents →](https://chain305.com/for-agents/)