Research
AI-hallucinated packages, Nov 2–8, 2026: 180 new names
The Brief
- A weekly tracker recorded 180 new AI-hallucinated package names for Nov 2–8, 2026.
- The tracker queries several LLMs every six hours for packages on ordinary tasks and logs names that do not exist.
- Some of these hallucinated names were later registered by someone after a model suggested them.
Why it matters
Developers who copy package names from LLM output can install packages that do not exist or that were registered by attackers, a risk known as slopsquatting.
Who’s affected
- Developers using LLM-generated code or install commands
What to do
- Verify that every package name suggested by an LLM exists and is the intended project before installing it
- #slopsquatting
- #ai-hallucination
- #package-security
- #supply-chain
- #llm
Published first at https://vdb.ai.kr/blog/slopsquatting-week-2026-11-08 . Every week: the package names LLMs recommended that do not exist, and the ones somebody registered after a model said them. Every six hours VDB asks several LLMs for packages to use on ordinary tasks and…
Timeline
Week of Nov 2–8 tracked by VDB; 180 new hallucinated package names recorded
Summary published on DEV Community
DEV Community: python
AI-hallucinated packages, Nov 2–8, 2026: 180 new names