The reliance of popular programming languages such as Python and JavaScript on centralized package repositories and open-source software, combined with the emergence of code-generating Large Language Models (LLMs), has created a new type of threat to the software supply chain: package hallucinations.
When a coding model does not know the library for a job it will often name one anyway, and the name is plausible. Across 576,000 generated Python and JavaScript samples from sixteen models, this study found 5.2 percent of imports from commercial models and 21.7 percent from open-source ones pointed at packages that do not exist, amounting to 205,474 distinct invented names. The finding that makes it a supply chain problem rather than a nuisance is the repetition: re-run the same prompt ten times and 43 percent of the invented names come back every single time. That makes them predictable enough to register in advance, which is the attack now called slopsquatting: the attacker does not need to guess what a developer will type, only what their assistant will invent. Presented at USENIX Security 2025.
