Agent installs a package that doesn't exist (yet)
A USENIX Security paper found code LLMs invent package names often, which attackers can register: so-called slopsquatting.
- Agents
- Code-generating LLMs
- Reported
- Source checked
- Tags
- dependencies, npm, pypi
Symptom
Generated code imports or installs a package that you've never heard of, with few downloads or a very recent publish date.
Cause
Models hallucinate plausible package names. The paper reports at least 5.2% hallucinated packages for commercial models and 21.7% for open-source models, with 205,474 unique hallucinated names.
Fix
Don't let agents install new dependencies unreviewed. Check that each new package exists, has a history, and is the one you meant, and pin it in a lockfile.
# Before accepting a new dependency from an agent
npm view "$PKG" name time.created repository.url --json || echo 'does not exist'
# Python
pip index versions "$PKG"
# Enforce lockfile installs in CI
npm ci