Top AIs invent same fake PyPl and npm package names

Multiple AI coding tools consistently hallucinate (generate false information about) the same fake software package names, creating a security risk called slopsquatting, where attackers register these nonexistent packages as malicious software to trick developers into using them. Researcher Aleksandr Churilov found that five different AI models generated 127 identical fake package names, with 53 of those names still available for malicious registration as of April. While no active attacks using these fake packages have been detected yet, the consistent hallucinations across different AI systems pose an ongoing threat to enterprise developers.