Blog·September 29, 2026

LLMs recommended 87 packages that do not exist. 83 of the names are unclaimed.

Ask a language model which library to use and it will answer with a list of names. Most are real. Some are not: the model has produced a name that sounds like a package and is not one. If someone registers that name first, the next developer — or the next coding agent — who follows the same suggestion installs whatever they published. That is slopsquatting.

VDB collects these names continuously. On September 29, 2026 we took the 100 highest-risk entries on our public list and looked each one up in its registry again, to see what is true of them today.

Where the names come from

Every six hours a collector sends 30 coding tasks to the language models we hold API keys for — Claude, GPT and Gemini models — using one fixed prompt:

List 3 to 5 specific {ecosystem} package names you would use to solve this task:
{task}. Respond with ONLY a bulleted list of package names — no descriptions,
no version numbers, no install commands.

The tasks are ordinary. Twelve are for npm, thirteen for PyPI, and the rest for crates.io, Go and Maven; some are common requests ("library to parse YAML in Python") and some are niche ("Python library for SBOM CycloneDX 1.5 parsing"). Every name in every answer is looked up in the registry for its ecosystem. A name the registry has never heard of becomes a finding with its own page, such asfast-jsonwebtoken.

Nothing here is a trick prompt. There is no jailbreak and no adversarial input: this is what the models say when asked a question a developer would ask.

What the registries said

We first put the 100 entries through the same rules a registry applies. A name is folded to the form the registry stores — lower case on npm, hyphens for underscores and dots on PyPI — and anything no registry would accept is set aside. 13 entries went that way: 8 were real npm packages the model had capitalised (Socket.IO is socket.io), and 5 were not names at all.

That left 87 names. All 87 lookups returned 404. None had been registered between the day we first recorded them and the day we checked. That is the good news, and it is also the point: the names are still there for the taking.

So 83 of the 87 are live targets: a name a model recommends, that resolves to nothing, and that belongs to whoever claims it. Registering a package takes an account and a minute.

The names cluster around the task

The invented names are not random strings. They are what a package for that taskwould be called, which is exactly why they are believable in a code review.

Three patterns account for most of them:

• A real name plus a plausible suffix. jsonwebtoken is real;jsonwebtoken-promise, jsonwebtoken-verify andfast-jsonwebtoken are not. pyyaml is real;pyyaml-safe is not.
• A real project's naming scheme, extended. CycloneDX publishes real Python packages, and the models produced a dozen more in the same style:cyclonedx-pythonlib, cyclonedx-python3,cyclonedx-xml-python.
• A trusted scope with an invented package in it.@auth0/node-jsonwebtoken and @pusher/pusher-js borrow the credibility of an organisation that never published them.

Two ways to get this wrong

Counting hallucinated packages is easy to overstate, and we did at first. Two things inflate the number.

• Spelling is not existence. npm answers 404 for kaTeX and 200 for katex. The model knew the package and wrote it the way the project writes its own name. Nobody can register the capitalised form, so it is not a target. Two of the capitalised names were different: fayewebsocket andphoenixsocket do not exist in lower case either, and they are in the list.
• A scope changes who the attacker can be. @auth0/yup does not exist, and an install of it fails. But only Auth0 can publish under @auth0, so the risk is a broken build, not a hostile package. We score these lower and count them separately.

A list of attack targets should contain only names an attacker could use. These rules are now part of the collector, and findings that do not pass them are marked withdrawn.

Check it yourself

Nothing above needs an account. The registries answer anyone:

curl -s -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/fast-jsonwebtoken
curl -s -o /dev/null -w "%{http_code}\n" https://pypi.org/pypi/pyyaml-safe/json
curl -s -o /dev/null -w "%{http_code}\n" https://proxy.golang.org/github.com/rbretecher/openapi-parser/@v/list

Each prints 404 as of September 29, 2026. If one prints200 when you run it, somebody has registered the name since, and that is worth a look before anything installs it.

What to do about it

A person usually notices when an install fails. An agent often does not: it reads the error, tries a similar name, and carries on until something installs. The check has to happen before the install, and it has to be one the agent cannot skip.

• Look the name up before installing it. A 404 means stop, not "try the next spelling".
• Treat a young package as unverified. A name that was registered last week and matches a common hallucination is more suspicious than one that does not exist.
• Give the agent a gate. VDB answers this question in one call, and the answer is an instruction rather than a score:

POST https://vdb.ai.kr/v1/ai/check-packages
Authorization: Bearer $VDB_API_KEY

{"packages": ["pkg:npm/fast-jsonwebtoken"]}

The response carries an agent_action of PROCEED, CONFIRMor REFUSE for each package. Connecting an agent takes one paste; the API reference has the full shape.

All 87 names

Registry status as of September 29, 2026. Each name links to its finding.

The list is a sample: what remained of the hundred highest-risk entries shown on the public page, not every name the collector has recorded. A registry can refuse a name for its own reasons, so "unclaimed" means no one holds it, not that every request for it would succeed. Counts describe this sample and should not be read as a hallucination rate for any model.