Hallucinated packages: dependencies an ai model made up, which an attacker can register.

01Definition

An import of something nobody published.

Language models sometimes write code that imports a package that has never existed, because the name sounds plausible. In a pull request this shows up as a new dependency in a manifest such as package.json, or an import of a package that is not installed.

If nobody owns that name, the install fails, which is the harmless outcome. The dangerous outcome is when someone has registered it.

• Plausible names, never published
• Show up as new dependencies
• Fail to install, or worse

02The risk

A made-up name is an open invitation.

Because models tend to repeat the same invented names, an attacker can register them in a public registry and wait for AI-written code to install them. The practice is sometimes called slopsquatting, by analogy with typosquatting. The package then runs with the permissions of whoever installs it, often a developer machine or a CI runner.

The defence is simple and mechanical: check every newly added dependency against the registry before trusting the change, and treat a brand-new, unknown package with suspicion.

• Attackers register invented names
• Install scripts run with your permissions
• Check every new dependency

03In Verify

Built: every newly added npm dependency is looked up.

Verify's dependency-existence check looks up each npm dependency a pull request adds. A dependency that does not exist in the registry is flagged in the verdict, so a reviewer sees it before anyone installs it.

Built; Verify is not installable yet. Other ecosystems come later.