The discovery: Researcher Bar Lanyado asked multiple LLMs (including GPT-4, Claude, and Gemini) to write code for common development tasks. He logged every package name the models recommended and checked each against npm and PyPI.

The pattern: He found hundreds of hallucinated package names across six LLM models. Critically, the same non-existent packages were hallucinated consistently across different sessions and models — making the names predictable to an attacker.

The attack path: Attacker identifies a commonly hallucinated package name → registers it on npm or PyPI with malicious code → waits. Developer asks LLM for help → LLM recommends the hallucinated name → developer installs it → compromised.

The term: “Slopsquatting” — squatting on the names LLMs produce as slop (hallucinated output).