STUPID-2026-0033

Slopsquatting: LLMs hallucinate package names attackers pre-register (react-codeshift, unused-imports)

7.0high
February 1, 2026Source checked

Why 7/10

Attackers registered hallucinated package names and real installs followed. What each malicious package did to installers is not documented.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
1/3
Fully recovered, with effort
Did it happen
2/2
Happened in real use
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Recommend or install packages while generating code.

  2. Expected behavior

    Only reference packages that actually exist and are verified before installation.

  3. Actual behavior

    Across 576,000 code samples from 16 LLMs, roughly 19.7% of recommended packages did not exist. 43% of hallucinated names recurred on every one of ten identical runs — predictable enough that attackers pre-register the names as malware.

  4. Damage

    Attackers registered hallucinated names such as react-codeshift (a conflation of jscodeshift and react-codemod) and unused-imports (instead of eslint-plugin-unused-imports). One malicious package was still recording ~233 weekly downloads weeks after being flagged.

Full write-up

'Slopsquatting' is a supply-chain attack that weaponizes a systematic AI failure: coding agents confidently recommend packages that do not exist. Across 576,000 code samples generated by 16 different LLMs, roughly 19.7% of recommended packages were hallucinations — and when identical prompts were re-run ten times, 43% of the fake names appeared on every single run. That predictability is the exploit: an attacker runs a few dozen prompts, harvests the names that consistently recur, and registers them as malware before anyone else. Documented cases include react-codeshift (a name an LLM produced by conflating the real jscodeshift and react-codemod tools) and unused-imports (hallucinated in place of eslint-plugin-unused-imports). npm's typosquatting collision detection offers no defense, because hallucinated names are brand-new strings with nothing to collide against.

Classification

Agent
Multiple LLMs
Failure mode
Hallucination
Root cause
Training Data Gap
Domain
Backend
Language
Javascript
OWASP Agentic Top 10 (our mapping)
ASI04 Agentic Supply Chain Vulnerabilities list
MIT AI Risk Repository (our mapping)
3.1 False or misleading information · 2.2 AI system security vulnerabilities and attacks taxonomy
Source
News Report

Related incidents

7.0
Claude Code in auto mode ran an unrequested Remove-Item -Recurse -Force and permanently deleted two days of research after a source/destination name collision during a copy task (GitHub #94453)
5.0
Claude Code's session-cleanup routine deletes any user file whose name starts with digits, mistaking it for a dead process's stale PID file
2.0
Devin docs PR rejected by Prefect maintainers — documented behavior from removed feature
5.0
AI 'slop' vulnerability reports flooded curl until it killed its bug bounty
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0033: Slopsquatting: LLMs hallucinate package names attackers pre-register (react-codeshift, unused-imports)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0033/ (accessed 2026-10-29). CC BY 4.0.

← STUPID-2026-0032By IDSTUPID-2026-0034 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.