Researchers prove slopsquatting: hallucinated 'huggingface-cli' package downloaded 30,000+ times once registered

Bar Lanyado of Lasso Security noticed LLMs repeatedly recommending a Python package that did not exist — 'huggingface-cli' (the real install is 'huggingface_hub[cli]'). He registered the hallucinated name on PyPI as an empty placeholder and watched it accumulate more than 30,000 authentic downloads in the following three months, including references in real GitHub projects' install instructions. The experiment proved an attacker can pre-register the package names AI assistants invent and let developers install malware themselves — a technique later named 'slopsquatting'.

What this means for youIf you or your team use AI coding assistants, check that any package they suggest exists on the official registry and matches the project's documented install command before running it. Businesses should require developers to verify dependencies instead of pasting AI-suggested install commands.