To show an attack vector, a researcher made a package with a name hallucinated by ChatGPT that had 30K+ downloads in three months and appeared in many repos
Bar Lanyado / Lasso Security :
Context & Ripple Effects
The demonstration extends an older package-registry weakness: attackers can exploit names that developers are likely to select by mistake, as shown by typo-package experiments that reached thousands of hosts. Here, the likely mistake originates in an AI-generated dependency suggestion rather than a keyboard typo.
The result also supplies an early concrete example of what later coverage termed “slopsquatting”: registering packages under plausible but nonexistent names produced by AI systems. Its download and repository presence show that a generated name can propagate beyond a single prompt.
First-order effects
- Developers and repositories that accepted the hallucinated package name face an immediate dependency-selection risk: a malicious publisher could occupy the same kind of name before users verify whether it is a real library.
- The demonstration gives security teams a testable signal to review—dependencies whose names originated in AI-assisted code or documentation suggestions, especially when provenance is unclear.
Second-order effects
- Package registries, dependency scanners, and AI coding tools face pressure to make package identity and provenance easier to verify, rather than treating a syntactically plausible name as sufficient.
- Attackers can shift from traditional typo targeting toward monitoring and registering likely AI-invented names, broadening the supply-chain attack surface without needing to compromise an established package.
Third-order effects
- If AI-generated dependency recommendations become routine, open-source package trust will increasingly depend on provenance checks at installation and review time, not just on users recognizing familiar names.
- This points to a wider open-source distribution trust problem: automation can speed legitimate development while also creating scalable paths for malicious packages to enter downstream projects.
The trend: AI-assisted development is creating a new software-supply-chain risk class in which model-generated identifiers can become attacker-controlled dependency names.