Hallucinated Package Guard for AI Coding Assistants (Slopsquatting Defence)
AI coding assistants sometimes suggest packages that do not exist. Attackers can register those names and wait. Build a guard that checks every new dependency added to a project, by a person or an AI, against the real registry: does it exist, how old is it, who maintains it, does it look like a typo of a popular package, and was it suggested by an AI? It runs in the editor, as a pre-commit hook and in CI.
Beginner
Achievable by one student in a semester with familiar tools.1 semester · 1 to 2 students
6 to ship
3 optional extrasSuggested stack
What you should ship
- A CLI that diffs dependency files (package.json, requirements.txt, pyproject.toml) and checks each new package against npm or PyPI
- Checks for non-existent packages, very new packages, very low downloads, maintainer changes, install scripts and names close to popular packages
- A pre-commit hook and a GitHub Action that comment on pull requests with clear, human-readable reasons
- A small experiment: prompt two or three coding models for code in a few domains, collect the packages they import, and measure how many do not exist
- A curated allow list feature so a team can approve packages once
- A short write-up of findings and limitations
If you have time left
- A VS Code extension that warns as soon as an import line names an unknown package
- Support for Maven or NuGet
- Using OpenSSF Scorecard data as an extra signal
The problem: the package the AI invented
Ask a coding assistant for code and it imports a library. Usually the library is real. Sometimes it is not. "We Have a Package for You!" (Spracklen and colleagues, USENIX Security 2025) generated 576,000 code samples with 16 models and found an average hallucinated-package rate of at least 5.2% for commercial models and 21.7% for open source models, with over 205,000 unique invented names. Many invented names repeat across prompts, so an attacker can register them on npm or PyPI with malicious code. Security researchers call this "slopsquatting".
A student or junior developer pastes the code, runs the install, and the attacker's package runs on their laptop.
What already exists and the gap
- Socket, Snyk and GitHub Dependabot watch dependencies for known vulnerabilities and some suspicious behaviour.
- OpenSSF Scorecard rates the security practices of open source projects.
- Typosquatting detectors compare names with popular packages.
These are mostly built around known-bad packages and established projects. The gap is a free, lightweight guard focused on the moment a new dependency appears: is it real, is it suspiciously new, does it look invented, and did an AI suggest it? It is also a gap in teaching: few students know this risk exists.
Inspiration
The USENIX paper above, and the OWASP Top 10 for LLM Applications (2025), which lists supply chain as a risk. The OpenSSF security guide for AI code assistants gives practical advice your tool can enforce.
What you build
- The checker that runs on dependency diffs.
- Hooks for pre-commit and GitHub Actions that comment with reasons, not just a red cross.
- An experiment that measures hallucinated packages in models you can access, in Python and JavaScript, on tasks a student might ask.
The technically interesting part
- Signals that are cheap and reliable. Registry metadata gives creation date, version count and maintainers. Combine them into a score you can explain in one sentence.
- Near-miss names. Edit distance and common patterns (hyphen versus underscore, plural forms, "py" prefixes).
- Honest measurement. A package not existing today is clear. A package that exists but was registered last week after being hallucinated is the dangerous case; record dates carefully.
How you will evaluate it
- On a list of real, popular, new and invented package names, how many does the guard flag correctly?
- How often does it block legitimate new packages in real projects (use a few open source repositories' histories)?
- Your hallucination experiment results, with method and limits.
Path to a product
The guard is useful to every team using AI coding tools. An open source core with a paid organisation dashboard, or a hosted GitHub App, are realistic paths. It is also a strong portfolio piece for security and developer tooling roles.
Scope warning
Never register hallucinated package names yourself, even to "prove" the attack; report counts instead. Keep to two ecosystems.
Learn what you need on Sefism
- AI security roadmap: the AI supply chain and how coding assistants fail.
- AI coding roadmap: how AI coding tools are used day to day, and how to check their output.
- OpenSSF security guide for AI code assistants: practices your guard can enforce.
- GitHub Actions documentation: building the CI check.
- GitHub Docs: code security: how Dependabot and code scanning fit alongside your tool.
- How to check if AI-generated code is correct: the wider habit this project builds.
- Which AI tools do employers expect junior developers to know in 2026?: the coding assistants whose suggestions you are guarding.
Get help with this idea
The risk is a guard that cries wolf on every new package. Tauseef can help you choose signals, design the experiment and write up the results clearly. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.