# The AI Squatting Taxonomy Problem Is Obscuring a Simple, Dangerous Truth
Three names. One attack. And the security community's habit of branding every variant into its own category may be doing real harm by making defenders chase ghosts instead of patching the hole.
Slopsquatting. Phantom squatting. HalluSquatting. Since AI coding assistants went mainstream, researchers have coined a term for every flavor of the same underlying exploit: an AI system confidently recommends a package, repository, or domain that doesn't exist, an attacker claims that name first, and the next developer who follows the AI's advice installs malware.
The attack is elegant in its simplicity. It requires no zero-day, no phishing campaign, no brute force. It requires patience and a free account on npm or PyPI.
## How Late-Binding Turns Hallucinations Into Weapons
The technical term ActiveState uses — "late-binding attack" — is the right frame. The malicious package doesn't need to exist when the AI generates the code suggestion. It only needs to exist when the developer runs pip install or npm install. That gap, sometimes minutes, sometimes months, is the attack surface.
AI coding assistants hallucinate package names for mundane reasons: training data that referenced packages later removed from registries, plausible-sounding interpolations between real package names, or simple statistical noise in token generation. The models aren't "lying" — they're doing what they were built to do, predict likely next tokens — and a package name like react-auth-utils or fastapi-jwt-helper is statistically plausible even if it doesn't exist.
Attackers don't need to monitor every AI conversation. They only need to systematically register names that fit common hallucination patterns: hyphenated combos of popular framework names, utility-sounding packages in high-usage ecosystems. Some researchers have demonstrated this by prompting AI assistants repeatedly and cataloguing the hallucinated names that appear most often. The intersection of "frequently hallucinated" and "currently unregistered" is a shopping list for a supply chain attack.
## This Isn't New. That's the Problem.
The dependency confusion attack Alex Birsan published in February 2021 compromised internal systems at Microsoft, Apple, Shopify, Tesla, and others using a different but structurally identical mechanism: if an internal package name leaks into a public registry lookup, an attacker who claims that name in the public registry wins. Birsan earned over $130,000 in bug bounties and demonstrated that package managers are architecturally trusting systems operating in an adversarial environment.
Slopsquatting is dependency confusion with an AI intermediary generating the target names instead of leaking internal documentation. The attack surface grew because the population of potentially hallucinated names is vastly larger than the population of leaked internal package names. Every developer prompt to every AI coding assistant is a potential hallucination event. Multiply that by millions of daily Copilot queries and the math starts to look uncomfortable.
The typosquatting lineage is older still — lodash vs. 1odash, requests vs. request. But typosquatting required the developer to make a mistake. Slopsquatting requires the developer to do exactly what they were told. That shift matters for how defenders think about the problem.
## The Rebranding Trap
Here's what concerns me about the taxonomy proliferation: every new brand name fragments the defender community's attention and creates the impression that there are multiple distinct threats requiring distinct countermeasures. There aren't.
The countermeasures for slopsquatting are the same countermeasures you should already have in place for dependency confusion and typosquatting:
Verify before you fetch. Before any package installation hits a registry, check that the package exists, has a publication history, has legitimate maintainers, and matches what you expect. Tools like Socket, Snyk, and Phylum do this. Lock files help. Private registries with explicit allowlists help more.
Treat AI suggestions as untrusted input. An AI-suggested package name has the same trust level as a package name a stranger handed you on a Post-it note. You wouldn't blindly install that. Review the suggestion, verify the package exists and is what it claims to be, and check its history before adding it to your project.
Govern your dependency pipeline. The organizations least exposed to this attack class are running governed dependency management: approved package lists, required review for new dependencies, automated SCA scanning in CI before merge. That's not a new recommendation. It's the same hygiene that would have blunted the impact of dozens of supply chain attacks going back years.
## What Changes When AI Is the Vector
That said, scale matters. Before AI coding assistants, a developer would typically research a package before adding it — check the GitHub repo, look at download counts, read the README. The AI suggestion creates a path of least resistance that skips that friction. In a fast-moving sprint with tight deadlines, a junior developer who asks an AI assistant for a solution and gets back working-looking code with a plausible package import is unlikely to stop and audit the package name.
The velocity of AI-assisted development is compressing the review window. That's the real threat multiplier here — not that the attack is novel, but that the preconditions for it to succeed (developer trust, speed, reduced scrutiny) are now systematically more present.
CI/CD pipelines that auto-install dependencies on every build are particularly exposed. If the lock file is absent or gets regenerated, a hallucinated package name baked into a codebase could trigger a malicious install at build time, in a privileged environment, without any human in the loop.
---
## HackWire Analysis
The slopsquatting discourse is suffering from a journalism problem as much as a security problem. Every new name gets a splashy blog post, a CVE-adjacent identifier, and a fresh round of coverage that largely repeats the same explanation without advancing what defenders should actually do. The result is a threat that sounds novel and complex but is neither.
What's genuinely underreported: the asymmetric economics of this attack. Registering a package name on npm costs nothing. Monitoring AI coding assistant outputs for hallucinated package names is automatable. A single successful implant into a widely-forked open source project or a popular enterprise dev environment could deliver the same impact as a sophisticated supply chain compromise — at a fraction of the cost and tradecraft.
The other underreported angle is organizational variance. Enterprises running tight software composition analysis and private registries are meaningfully protected. Individual developers, small shops, and open source maintainers using AI assistants without governed pipelines are not. The attack disproportionately targets the parts of the ecosystem with the least security overhead. That's where the next incident will come from, and it's where defenders with influence — package registry operators, AI coding tool vendors, large OSS foundations — should be focusing attention.
The fix is not complicated. It's boring and has existed for years. The only thing that changed is that AI made ignoring it more expensive.
— HackWire Editorial
---
## Related Coverage