Slopsquatting Has Three Names. The Attack Is the Same.

The security research community produced three names for the same attack this week. Slopsquatting. Phantom domains. HalluSquatting. Each one describes the same thing: an AI coding assistant generates a package name that doesn’t exist in any real registry, an attacker claims that name first, and the next build installs malware instead of nothing.

ActiveState published the unifying analysis on July 23, which BleepingComputer covered Thursday. The company terms it a “late-binding attack pattern”: the model suggests the import, the build system fetches it, and verification — when it happens at all — arrives after execution.

What the Attack Does

Language models generate plausible-looking package names that don’t correspond to anything in PyPI, npm, RubyGems, crates.io, or Go modules. Most of the time the fetch fails silently and nobody notices. The attack requires only that an attacker harvest names that don’t exist yet, register them first, and wait for a developer’s CI pipeline to complete the delivery.

The harvesting is easier than it sounds. Hallucinated imports appear in code samples on GitHub, in open-source projects that incorporated AI-generated scaffolding, in developer forums where people paste LLM output directly. Registering a name in PyPI or npm is free and takes seconds. The attacker doesn’t need to be fast in the sense of faster than the developer — they need to be faster than the ecosystem notices.

The same pattern extends beyond package registries. ActiveState’s analysis notes it applies to repository hosting and domain names: AI-generated code that references a GitHub repo or CDN URL that doesn’t exist opens a registration window there as well. That’s the “phantom domains” framing from the research — all three target spaces, same underlying mechanism.

What Distinguishes This from Typosquatting

Classic typosquatting requires someone to make a spelling error, or a build script to have a typo. An auditor scanning for suspicious character substitutions has something to find. The hallucination variant offers no such tell: the package name the model generated looks intentional because the model generated it with full confidence. There’s no transposed letter. The name is simply wrong in a way that doesn’t look wrong to the developer who didn’t write it.

Both classes of attack exploit late resolution — the registry lookup happens at build time, not design time — but the typosquatting attacker needs a human mistake, and the hallucination attacker needs the model to do what models do.

The Fix

Pre-fetch verification — confirming a package exists in the expected registry and matches expected metadata before any build step pulls it — closes the primary window. Governed dependency management (pinned versions, lockfiles, internal mirrors with curated allowlists) adds a second layer. For teams already running those controls against typosquatting, there’s no new remediation step. The exposure depends on the same gap.

ActiveState’s full recommendations include reviewing any AI-generated code in your build graph that references packages not already in your lockfile. If a name appears in LLM-generated scaffolding and isn’t in your pinned dependency list, verify it exists and was published by the expected maintainer before it reaches production.

Supply-chain attacks on open-source registries were a growing problem well before AI coding assistants existed. The DPRK-linked npm campaigns and fake PoC packages on GitHub and PyPI relied on exactly the same delivery mechanism: developers fetching packages without checking who published them. The hallucination variant gives attackers a new source of pre-targeted names. The rest of the chain hasn’t changed.

Three names. One fix. Neither is new.

Source: Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack — BleepingComputer, July 24, 2026, reporting on ActiveState research.