AI-hallucinated packages, Nov 2–8, 2026: 180 new names
Published first at https://vdb.ai.kr/blog/slopsquatting-week-2026-11-08 . Every week: the package names LLMs recommended that do not exist, and the ones somebody registered after a model said them. Every six hours VDB asks several LLMs for packages to use on ordinary tasks and checks each name against the registry. This is the week of Nov 2–8, 2026: 180 names seen for the first time, 10 produced…
During the week of November 2-8, 2026, 180 new package names were recommended by various large language models (LLMs) that did not exist in their respective registries. VDB, a monitoring service, asked multiple LLMs for package names to use on ordinary tasks and checked each name against the registry. This week, 2,199 names were live in the list, with 180 seen for the first time and 10 produced again by at least one model.
The most hallucinated names this week were ranked by how many models agreed on them. A name produced by two models was considered the one an attacker should expect to pay off. Among the top names, 103 were seen on PyPI, 47 on npm, 25 on crates.io, and 5 on Go. The most frequent models producing names were gpt-4o-mini, with 158 names, and claude-haiku-4-5, with 22 names.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
