Why is installing a PyPI package your AI assistant suggested but nobody recognises risky?
answer
- the suggestion itself is the attack surface
- models invent names that fit conventions
- same invented name across many users
- attacker registers it and waits
- no correct spelling to compare against
basics
~20 sAI assistants invent plausible package names that were never published. Attackers collect those hallucinated names, register them on the public index, and wait for someone to install one. The name looks right precisely because a model generated it.
solid answer
~50 sLanguage models suggest the most plausible-looking package, not a verified one, so they routinely name helpers that do not exist. Because similar prompts produce the same invented name for many different developers, those hallucinations are predictable and enumerable: an attacker can harvest suggested names that resolve to nothing, register them on the public index, and publish whatever they like under them. That is slopsquatting. Unlike a misspelling squat there is no typo and no correct name to compare against — the model manufactured the demand, and the victim is more confident than usual because they asked for exactly this. Practically: before installing something new, confirm the project's own documentation names that package, look at whether the index page points at a real project with history, and route genuinely new dependencies through whatever review path your team uses for first-time names.
go deeper
Be ready to say plainly that a model can invent a package name, that anyone can register an unused name, and that you check a dependency against the project's real documentation before installing it.
Explain why the hallucinations repeat across users and are therefore harvestable, and why comparing a new name against your existing dependency names does not catch this class at all.
Show the operational answer: first-time-seen names get a human decision, the decision is recorded so it is paid once, and you treat the developer workstation and its credentials as the asset under attack.
Own the tradeoff of allowing AI-assisted development at all: where suggestions may be executed, what a disposable environment costs, and how you keep the ingest rule cheap enough that engineers do not route around it.
## What is actually happening An AI coding assistant produces the most plausible continuation of your prompt, not a verified fact. Ask for "a small library that signs tokens and validates them against a remote key set" and it will name something with exactly the shape you would expect: the right ecosystem naming conventions, a familiar prefix, a sensible suffix. Whether anyone ever published that name is a separate question the model did not check. The result is a **hallucinated dependency** — a package reference that is syntactically perfect and does not exist. ## Why a hallucination becomes an attack Hallucinated names are not random noise. Similar questions produce similar answers, so the same invented name surfaces again and again across many different users. That makes them **enumerable**: an adversary prompts models at scale, keeps the suggestions that resolve to nothing on the public index, registers those names, and publishes a package under each one. Registration on the major public indexes is free, immediate, and needs little more than an email address. Then they wait. Every developer who later receives the same suggestion now installs a package that really does exist — the attacker's. The name for this is **slopsquatting**, by analogy with typosquatting. ## How it differs from a misspelling squat | | Typo squat | Slopsquat | |---|---|---| | What the attacker predicts | your keystroke slip | the model's output | | Is there a correct name? | yes — the one you meant | no — nothing was meant | | Does a similarity check fire? | often, against the real name | no — it resembles nothing you use | | Victim's confidence | low; it was an accident | high; they asked and got an answer | That third row is the sharp edge. A gate that compares a new dependency name against the names you already depend on is aimed at near-misses. A hallucinated name is not near any of them — it is near your *intent*. The control that covers it is not "does this look like something else" but "have we ever seen this name before at all". ## What makes it land - **Naming conventions are regular.** Every ecosystem has such consistent prefixes, suffixes and word order that a fabricated name is indistinguishable from a real one by inspection. - **A brand-new package looks exactly like a legitimately new package.** No history is not evidence of malice, and most people treat it as no evidence at all. - **Installing is already a decision.** By the time you can read what a package does, your package manager has already fetched and unpacked it — and on many ecosystems it may have already run code from it. Reading the source *after* installing is not review. - **The blast radius starts at the workstation.** The machine that runs the suggested install is usually a developer laptop holding cloud credentials, signing material, SSH keys and a full source checkout. That is the asset at stake, and it is a better foothold than most production hosts. ## What actually defends 1. **Existence is not endorsement.** That the name resolves proves only that somebody registered it and uploaded an archive. Confirm the dependency is named by the project's own documentation, or by an internal service that already uses it. 2. **Ask where you learned the name.** From official docs or an existing internal dependency: reasonable. From a chat window: no provenance whatsoever, and the plausibility of the string is not evidence. 3. **Trigger on first-time-seen, not on look-alike.** Treat "nobody in this organisation has ever pulled this name" as the event that requires a human decision. This is the single rule that covers hallucinated names, because they trip no similarity metric. 4. **Record the decision.** An allow-list means the review cost is paid once per name, not once per install, which is what keeps the practice alive. 5. **Do not paste generated install commands into a credentialed machine.** If you must try something unknown, do it somewhere disposable. ## How to say it in an interview Lead with the asymmetry: the attacker's cost is a free registration and a wait; the payoff is code execution on a developer machine with production credentials. Then make the distinction that shows you understand the class — there is no misspelling here, so the classic defence of comparing against the correct name has nothing to compare with.
- How is this different from a classic misspelling squat?A misspelling squat predicts a keystroke slip, so there is a correct name and comparing against it is a real defence. Here nothing was misspelled: the invented name corresponds to your intent, not to a package you already use, so similarity checks against your existing dependencies never fire. The attacker also gets a more confident victim, because the developer asked for the package rather than mistyping it.
- The suggested package does exist on the index. Does that settle it?No. Existence proves only that someone claimed the name and uploaded an archive; public indexes do not review contents or verify that a package is what its name implies. Check that the project's own documentation or an existing internal dependency names it, look at who owns the name and whether ownership changed recently, and treat a name you have never pulled before as needing a decision regardless of whether it resolves.
- What makes a developer laptop a worthwhile target compared with a production server?It usually holds long-lived cloud credentials, registry and source-forge tokens, SSH keys and a complete checkout of code that has not shipped yet. It also has outbound network access and far less monitoring than a production host. Code that runs there can both exfiltrate secrets and modify source on its way into the pipeline, so it is often a cheaper route into production than production itself.
A shop opens at the address a broken map keeps sending people to. It does not have to resemble any real shop — the map created the foot traffic all by itself.
saying these in an interview costs you the question
- Assumes a hallucinated name will simply fail to install
- Thinks the assistant verified the package exists
- Treats presence on a public index as review or endorsement
- Calls it a typo squat and looks for the misspelling
- Judges a package genuine because the name reads plausibly