All posts
4 min read

AI Hallucinated a Package: Fake Libraries, Made-Up APIs, and Slopsquatting

AI coding tools sometimes invent packages, functions, and settings that don't exist — and attackers now register the fake package names. Why it happens, how to spot hallucinated imports and APIs, what 'slopsquatting' is, and the habits that keep invented code out of your app.

getting startedsecurityAI agentsbeginner

You ask an AI tool to add a feature. It writes clean, confident code that imports a helpful-sounding library: react-easy-calendar-sync. You run npm install. Either it fails — the package doesn't exist — or, worse, it succeeds, because someone has published a package with that exact name, full of malicious code.

AI models hallucinate: they produce plausible-looking things that aren't real. In code, that has specific, recognisable forms. (What Is an LLM? explains why it happens.)

The forms it takes

Invented packages

The model suggests installing a library that doesn't exist, because the name sounds like something that should: a combination of real library names, or a natural description of what it needs.

Invented functions and options

The package is real, but the function isn't:

import { formatRelative } from "date-fns"          // real
import { formatHumanFriendly } from "date-fns"     // not a real export

Or a configuration option that was never part of the library, or a command-line flag that doesn't exist.

Outdated APIs

The model learned an older version of a library, and writes code for it: functions that were renamed or removed in the current major version, deprecated patterns, old configuration formats. This isn't quite a hallucination — it was real once — but the effect is similar. (Semantic Versioning Explained.)

Invented facts about your own project

It references a file, function, or environment variable in your project that doesn't exist — because a project like yours would usually have one.

Slopsquatting: the security twist

Researchers found that AI models hallucinate package names repeatedly — the same invented names come up again and again for similar prompts. That makes them predictable.

Attackers exploit this: they register the hallucinated names on npm, PyPI, and other registries, and fill them with malicious code that runs when installed — stealing environment variables, API keys, and credentials. The technique has been nicknamed slopsquatting (a play on typosquatting, where attackers register misspellings of popular packages).

The danger is highest when an AI agent can install packages by itself, without a person checking the name.

How to spot a hallucinated package

Before installing anything unfamiliar, spend thirty seconds checking:

  • Does it exist on the registry? Search npmjs.com or pypi.org for the exact name.
  • Is it established? Look at weekly downloads, the number of versions, and when it was first published. A package created last week with a handful of downloads deserves suspicion.
  • Does it have a real repository? A linked GitHub repo with history, issues, and contributors.
  • Is the name exactly right? Watch for near-misses of popular packages.
  • Is it what the docs recommend? Official documentation for your framework usually names the standard library for common tasks.
  • Do you need it at all? Many "helper" packages replace a few lines of code.
npm view some-package-name     # shows details, or "404 Not Found"

How to spot invented APIs

  • Run the code. Invented functions fail fast: is not a function, has no exported member, Unknown option.
  • Use TypeScript. Type checking flags non-existent imports and properties before anything runs. (TypeScript for AI-Generated Code.)
  • Check the official docs for anything unfamiliar — especially configuration options, which often fail silently when wrong.
  • Check your installed version. npm ls package-name shows what you have; compare with what the code assumes.

Habits that keep it out

  1. Let the AI run the code. An agent that can execute code and read the errors catches most hallucinated functions itself. Agents that only write code can't.
  2. Review new dependencies. When reviewing an AI change, look specifically at package.json and the lock file. Every new dependency should be one you'd have chosen. (How to Read a Diff.)
  3. Require approval for installs. Keep package installation as an action your AI tool must ask about, rather than auto-approving it. (Claude Code Permission Modes.)
  4. Give it current docs. Point the AI at the documentation for the versions you use, or add a docs MCP server, so it isn't relying on memory. (What Is MCP?.)
  5. State your stack. Listing your main libraries and versions in CLAUDE.md reduces guessing. (How to Write a CLAUDE.md.)
  6. Isolate the environment. Run AI agents in a container or separate workspace, so a malicious install script can't reach your personal files, SSH keys, or other projects. (How to Run AI-Generated Code Safely.)

If you installed something bad

If you realise you installed a suspicious package:

  1. Remove it and restore your lock file from before.
  2. Rotate every secret the environment could see — .env values, cloud credentials, tokens. Install scripts can read them. (I Leaked an API Key. What Now?.)
  3. Check for changes it may have made, and scan the machine or rebuild the environment.

npm Supply Chain Security covers the deeper defences.

EasySpawn runs Claude Code in an isolated Docker workspace per project, with no access to your laptop, your other projects, or the host — so a bad package can only reach the one sandbox it was installed in. See how it works or join the waitlist.

Related: What Is an LLM? · How to Update Dependencies Safely · npm and package.json Explained

Keep reading