AI invented a package. Hackers made it real.

1. 1

   1 in 5 suggested packages didn't exist.

   Researchers tested 16 models on over 2 million package suggestions. 19.7% of them were made up.

2. 2

   The best models still make some up.

   The best one was around 3%. Much better, but still not zero.

3. 3

   Attackers register the made-up names.

   They publish a package under a name AI keeps inventing and put malware inside. It's called slopsquatting.

4. 4

   It works.

   A researcher published an empty package named after one AI kept inventing. It got over 30,000 downloads.

   pip install huggingface-cli
5. 5

   Check what AI installs.

   When AI adds a package, ask: does it exist? Who maintains it? How many downloads does it have?

Source · “We Have a Package for You!”, Spracklen et al., USENIX Security 2025