Fake package names
5.2–21.7%
Code models suggest dependency names that no registry has ever published. The rate is measured, the attack that exploits it has a name, and the defense takes one HTTP call.
A USENIX Security 2025 study prompted code-generating models for package recommendations and checked every suggested name against the registries. Between 5.2% and 21.7% of the names did not exist, with the rate depending on model and ecosystem. A 2026 replication confirmed the pattern persists in newer models.
The damage does not stop at the dependency file. An analysis of generated-code build failures traced 27.7% of compile errors to symbols that do not exist: functions, classes, and constants the model invented inside real packages. The errors look plausible. That is what makes them expensive. They surface late, after the code is written, reviewed, and sometimes merged.
An invented name is rarely random characters. Models compose them from real package names, so the same fake name recurs across users and sessions. "requestsx-fantasy-helper" reads like something that should exist.
Slopsquatting is the practice of registering those names on PyPI or npm and waiting. The attacker does not need to target you. The model does the targeting, and the install does the delivery. No panic is called for. The defense is boring and it works: confirm the name exists before it reaches your dependency file, and confirm the symbol exists before you call it.
All three ask the same deterministic oracle, which answers from real published artifacts: PyPI wheels parsed with the Python AST, npm packages through their .d.ts declarations. A "does not exist" answer names the artifact that was checked and is cryptographically signed. Retrieval tools cannot give you that negative; they only report what they found.
25 checks a day per client IP, no account. Enough to check any name a model suggests while you watch it work.
POST /demo/v1/package/existsuvx attester-mcp gives Claude Code, Cursor, or any MCP client four
oracle tools that work with zero config. Pair with a two-line rule and the agent
checks itself.
attester-import-check runs the check as a pre-commit hook, a Claude Code hook that blocks the write, or a GitHub Action on every PR. It fails open when the free quota or the network is down.
github.com/maminihds/attester-import-check# check a package name (free, no key) curl -X POST https://attester.dev/demo/v1/package/exists \ -H 'Content-Type: application/json' \ -d '{"ecosystem": "pypi", "name": "requestsx-fantasy-helper"}' # {"exists": false, "typosquat_adjacent": true, "adjacent_to": ["requests"], ...}
When 25 a day is not enough, the same answers cost $0.002 per package check and $0.005 per symbol check on the paid routes, payable per call with x402 or prepaid credits. Details in /llms.txt.