Slopsquatting: hallucinated by your agent, already registered by someone else

In January 2026, AI coding agents across 237 repositories kept trying to install a package called react-codeshift. The name is a plausible blend of two real tools, jscodeshift and react-codemod, exactly what a codemod-heavy React project would expect to need. Nobody had ever published it. The import first appeared inside a commit bundling 47 AI-generated Agent Skills, rode forks into 237 repositories, picked up a Japanese translation along the way, and kept collecting a handful of installs a day from other agents still executing the same skill.

A researcher at Aikido Security, Charlie Eriksen, found the hallucinated name before anyone with worse intentions did, and registered it defensively. The registry cannot tell a defensive claim from a malicious one, and neither can your install step. Whoever reaches an invented name first decides what every future install of it actually runs.

That's slopsquatting, and it's a different risk from triaging which upgrades are safe to run: that question is about whether a real package's new version can be trusted. This one is about whether the package is real at all, the sharpest edge of a problem this blog has already named: a wrong answer that looks right, now with a head start on becoming a supply-chain attack.

Why a hallucinated name is easy to steal

Package registries hand a name to whoever asks first. npm and PyPI were built for a world where a human typed the name they meant to publish, not one where a model invents a name it merely believes should exist, and the registry has no way to tell the difference.

That would still be a minor problem if hallucinated names were random. They aren't. Ask a model the same question ten times and the same wrong package name tends to come back, not a fresh guess every run. Aikido's researchers, drawing on the original USENIX Security study of the problem, found just over half of hallucinated Python and JavaScript packages were pure invention, and roughly four in ten were conflations exactly like react-codeshift: two trusted names blended into a third that was never real. An attacker does not need to guess. They query a model a few dozen times, keep the names that keep recurring, and register those before your install step ever runs.

Every engine invents the same fake names

Switching engines does not route around this. A 2026 study tested five frontier models, Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro and DeepSeek V3.2, across nearly 200,000 prompts, and found 127 package names every single one of them invented identically: 109 on PyPI, 18 on npm. When the researchers checked which were still unclaimed, 53 were, a model-agnostic attack surface sitting open no matter which of your Claude Code, Codex or Gemini CLI sessions happens to write the import.

Running three engines side by side does not triple your protection. It triples your chances of hitting the same short list of names an attacker already has reason to watch.

A skill file spreads the mistake faster than you can catch it

react-codeshift did not spread because 237 developers each typed the same wrong import by hand. It spread because the import was written once into an Agent Skill, a file whose entire purpose is to be read and acted on by other agents without a human rereading it line by line first. Fork the repository and the skill forks with it, hallucinated import included, ready for the next agent to treat as instruction rather than as code worth questioning. The instructions steer your agent as surely as any script runs on your machine, and one wrong line travels everywhere the skill gets reused.

Where slopsquatting goes wrong, and what it really costs

A postinstall script runs before anyone reviews a line of code. By the time a pull request shows a new dependency, npm or pip has often already executed whatever the package's install hook contained. A sandboxed install contains what that script can reach. An unsandboxed one hands it your whole machine, and reviewing the diff afterward only catches the import, not what already ran.

The boring name is the dangerous one. unused-imports sat in for the real eslint-plugin-unused-imports and was still pulling around 233 downloads a week months after npm put it on security hold, because the name is exactly the small, sensible kind nobody double-checks.

A clean lockfile only proves nothing changed since it was written. It pins whatever name was there the day someone committed it, real or invented, with identical confidence either way.

Unattended installs are the highest-risk surface of all. A CI job or an overnight agent loop running npm install on a schedule has no human anywhere near the moment a new name resolves. The install that would raise an eyebrow at 2pm raises nothing at 2am.

Where a new dependency gets a second look before it merges

SanuDesk is a desktop app built around exactly that gap. Your Claude Code, Codex and Gemini sessions tile into one grid, each with a live git pane beside it, so a new line in a lockfile is something you see forming next to the diff, not something you reconstruct from a postmortem afterward. Work arrives through a Kanban board: deploy a card and it opens a fresh session, and when the agent stops, the result parks in a review lane instead of merging itself, one more checkpoint between an invented name and your dependency tree. A weekly sweep of every lockfile against the registry, flagging anything new with a handful of downloads and a two-week-old publish date, becomes a Loop, journaled per run instead of a check nobody remembers to run by hand. It's bring-your-own-model, so the same review lane covers whichever engine wrote the import, and the grid and board are in the free plan (see pricing).

Check this week's lockfile before you trust it

Pick one dependency an agent added recently. Open the registry page for it directly and check two numbers: how long the package has existed, and how many people besides you have installed it. A package that's months old with a real download history is background noise. A package that appeared a few weeks ago with a two-digit download count is not proof of an attack, but it isn't nothing either, and it's a question worth answering before the next install runs somewhere you aren't watching.

Download SanuDesk free to keep a git pane and a review lane between every session and your dependency tree, or see how the grid, the board and Loops fit together on the features page.