MagSolutionsAIThe Hallucination Index
Package names that AI coding assistants invent, which do not exist in any registry — and which of them somebody has registered since. Published datasets record what models invent when prompted on benchmark tasks; this index records what actually reaches real pull requests.
We started recording on 24 Aug 2026. Empty does not mean idle: we run our own daily sweep over public pull requests, and the count below says how much we have looked at. Every name we have reviewed so far turned out to be a false positive of ours — an internal monorepo package, a version bump misread as a new dependency — and was removed after review rather than published. We do not seed this index from papers or from other people's datasets. An index of security data that inflates its own numbers is worth less than no index at all.
Loading the measurement…
What the machines keep making up
| # | Package name | Times seen | Registry status |
|---|---|---|---|
| No entries yet — see the note below. | |||
Where these numbers come from
We record package names only. No source code, no repository contents, no identifying information about the organisation that saw it — organisations are counted through a truncated hash, so we can say how many saw a name but never which.
This index is a lagging indicator, not a blocklist. A name absent from this table is not safe — it only means we have not seen it. Use the App for the live check.
About slopsquatting
▸What is slopsquatting?
Slopsquatting is a supply chain attack where an attacker registers a package name that AI coding assistants invent but which does not exist. Unlike typosquatting, which bets on human typing mistakes, slopsquatting bets on the names machines hallucinate. Because 43% of hallucinated names repeat for the same prompt, attackers can predict which names are worth registering.
▸How common are hallucinated package names?
A USENIX Security 2025 study (Spracklen et al.) generated 576,000 code samples with 16 models. Of the 2.23 million package names in them, 19.7% did not exist: an average of at least 5.2% for commercial models and 21.7% for open-source ones. A 2026 measurement of frontier models (arXiv 2605.17062) puts the rate between 4.6% and 6.1%. These rates are per package name suggested, not per pull request: an invented dependency usually breaks the install before it is ever committed. In 2024 a researcher registered huggingface-cli, a name models kept recommending but which never existed, and it received more than 30,000 downloads in three months. (Corrected 27 September 2026: an earlier version called the 2.23 million package names code samples.)
▸Why don't conventional dependency scanners catch this?
Conventional scanners look up known vulnerabilities in real packages. A package name registered five minutes ago has no CVE, no advisory and no history, so it is invisible to them by design. Detecting it requires asking the registry whether the name exists at all.
▸How can I check whether a package really exists?
Query the registry directly. For Python: curl -sI https://pypi.org/pypi/PACKAGE/json returns HTTP 404 if the package does not exist. For npm: https://registry.npmjs.org/PACKAGE. Existence alone is not enough, though: also check how old the package is and how many downloads it has, because a claimed slopsquat does exist.
Check your own dependencies
The scanner on the home page queries the live registry from your browser. Nothing is uploaded, nothing is stored, no signup.