Slopsquatting candidates — names attackers will target next
Package names multiple LLMs repeatedly hallucinate are exact targeting information for attackers — "register this and someone will install it". We see those names before attackers do.
How we detect
We regularly run a matrix of hundreds of programming prompts through major LLMs (Claude, GPT, Gemini, Llama) and harvest the package names they recommend. Cross-model agreement raises the target score. The registry status is checked live against npm/PyPI/crates.io for (1) non-existence, (2) recent registration with suspicious patterns, and (3) empty wrappers around famous names.
Bulk package check
Paste package names suggested by an LLM, one per line. Flagged candidates appear below.
| id | purl | risk | summary |
|---|---|---|---|
| VDB-SLOP-npm-52bbc73de1 | pkg:npm/Nimbus | high | Slopsquatting candidate: Nimbus (npm) |
| VDB-SLOP-npm-298d52cfd4 | pkg:npm/nxtjwt | high | Slopsquatting candidate: nxtjwt (npm) |
| VDB-SLOP-npm-73ff7581f7 | pkg:npm/@pusher/pusher-js | high | Slopsquatting candidate: @pusher/pusher-js (npm) |
| VDB-SLOP-npm-569243c633 | pkg:npm/cron-expresso | high | Slopsquatting candidate: cron-expresso (npm) |
| VDB-SLOP-npm-a8b8dbbca9 | pkg:npm/jsonwebtoken-promise | high | Slopsquatting candidate: jsonwebtoken-promise (npm) |
| VDB-SLOP-npm-e6e0f0d6af | pkg:npm/ts-nexus | high | Slopsquatting candidate: ts-nexus (npm) |
| VDB-SLOP-npm-56c9ea855f | pkg:npm/fast-jsonwebtoken | high | Slopsquatting candidate: fast-jsonwebtoken (npm) |
| VDB-SLOP-npm-273ad31c61 | pkg:npm/node-json-web-token | high | Slopsquatting candidate: node-json-web-token (npm) |
| VDB-SLOP-npm-0a2586283e | pkg:npm/optimistic-jwt | high | Slopsquatting candidate: optimistic-jwt (npm) |
| VDB-SLOP-npm-f06134747e | pkg:npm/@auth0/node-jsonwebtoken | high | Slopsquatting candidate: @auth0/node-jsonwebtoken (npm) |
| VDB-SLOP-npm-d8259adfe9 | pkg:npm/json-deep-clone | high | Slopsquatting candidate: json-deep-clone (npm) |
| VDB-SLOP-npm-e6d49bf29d | pkg:npm/ical-parse | high | Slopsquatting candidate: ical-parse (npm) |
| VDB-SLOP-npm-580daa2559 | pkg:npm/momend | high | Slopsquatting candidate: momend (npm) |
| VDB-SLOP-npm-ce17f68b13 | pkg:npm/jsonwebtoken-3 | high | Slopsquatting candidate: jsonwebtoken-3 (npm) |
| VDB-SLOP-npm-79cdc20ed7 | pkg:npm/clone-dedeep | high | Slopsquatting candidate: clone-dedeep (npm) |
| VDB-SLOP-npm-b8706ad3c0 | pkg:npm/Bitfinex-api-node | high | Slopsquatting candidate: Bitfinex-api-node (npm) |
| VDB-SLOP-npm-45a53bc238 | pkg:npm/browser.ws | high | Slopsquatting candidate: browser.ws (npm) |
| VDB-SLOP-npm-509c848aa7 | pkg:npm/robust- | high | Slopsquatting candidate: robust- (npm) |
| VDB-SLOP-npm-3496e2da1f | pkg:npm/5. | high | Slopsquatting candidate: 5. (npm) |
| VDB-SLOP-npm-155e988205 | pkg:npm/Realtime | high | Slopsquatting candidate: Realtime (npm) |
| VDB-SLOP-npm-4fdc977857 | pkg:npm/Native-WebSocket | high | Slopsquatting candidate: Native-WebSocket (npm) |
| VDB-SLOP-npm-d3f3113357 | pkg:npm/JWT-simple | high | Slopsquatting candidate: JWT-simple (npm) |
| VDB-SLOP-npm-c646055ee9 | pkg:npm/plugin-sql | high | Slopsquatting candidate: plugin-sql (npm) |
| VDB-SLOP-npm-a1bf4ad976 | pkg:npm/clone-deep-array | high | Slopsquatting candidate: clone-deep-array (npm) |
| VDB-SLOP-npm-1d2791c744 | pkg:npm/big-ical | high | Slopsquatting candidate: big-ical (npm) |
| VDB-SLOP-npm-f3f3ac6e8f | pkg:npm/event-source- | high | Slopsquatting candidate: event-source- (npm) |
| VDB-SLOP-npm-4236656172 | pkg:npm/lodash.deepcopy | high | Slopsquatting candidate: lodash.deepcopy (npm) |
| VDB-SLOP-npm-2dfa33e4a3 | pkg:npm/icalParser | high | Slopsquatting candidate: icalParser (npm) |
| VDB-SLOP-npm-90ed39b31a | pkg:npm/RPC-websockets | high | Slopsquatting candidate: RPC-websockets (npm) |
| VDB-SLOP-npm-be85b208f3 | pkg:npm/kaTeX | high | Slopsquatting candidate: kaTeX (npm) |
| VDB-SLOP-npm-11f249b4f4 | pkg:npm/sql-escape-strings | high | Slopsquatting candidate: sql-escape-strings (npm) |
| VDB-SLOP-npm-76aef3870a | pkg:npm/p- | high | Slopsquatting candidate: p- (npm) |
| VDB-SLOP-npm-ea0261ae18 | pkg:npm/Request-promise | high | Slopsquatting candidate: Request-promise (npm) |
| VDB-SLOP-npm-9ce5527b8b | pkg:npm/cron-syntax-parser | high | Slopsquatting candidate: cron-syntax-parser (npm) |
| VDB-SLOP-npm-06e0b0c7cd | pkg:npm/simplest-chat-app | high | Slopsquatting candidate: simplest-chat-app (npm) |
| VDB-SLOP-npm-d02fa9d70d | pkg:npm/phoenixSocket | high | Slopsquatting candidate: phoenixSocket (npm) |
| VDB-SLOP-npm-bc1da1135d | pkg:npm/pgweb | high | Slopsquatting candidate: pgweb (npm) |
| VDB-SLOP-npm-9a129d2bd4 | pkg:npm/schedule-collision-detector | high | Slopsquatting candidate: schedule-collision-detector (npm) |
| VDB-SLOP-npm-931bfb7a69 | pkg:npm/Socket.IO | high | Slopsquatting candidate: Socket.IO (npm) |
| VDB-SLOP-npm-27c66cf52c | pkg:npm/crypto- | high | Slopsquatting candidate: crypto- (npm) |
| VDB-SLOP-npm-3f444e3786 | pkg:npm/pev-websocket-client | high | Slopsquatting candidate: pev-websocket-client (npm) |
| VDB-SLOP-npm-9731113f6a | pkg:npm/simple-ical-parser | high | Slopsquatting candidate: simple-ical-parser (npm) |
| VDB-SLOP-npm-acc745887a | pkg:npm/cronutils | high | Slopsquatting candidate: cronutils (npm) |
| VDB-SLOP-npm-740fa9d8a4 | pkg:npm/schedule-utils | high | Slopsquatting candidate: schedule-utils (npm) |
| VDB-SLOP-npm-2d05a508fc | pkg:npm/schedule-validator | high | Slopsquatting candidate: schedule-validator (npm) |
| VDB-SLOP-npm-1be5b600bc | pkg:npm/ts-sql-parser | high | Slopsquatting candidate: ts-sql-parser (npm) |
| VDB-SLOP-npm-6bb35397ef | pkg:npm/uzwebsocket | high | Slopsquatting candidate: uzwebsocket (npm) |
| VDB-SLOP-npm-a994ede4db | pkg:npm/ics-to | high | Slopsquatting candidate: ics-to (npm) |
| VDB-SLOP-npm-4b7a7a8daf | pkg:npm/sql-walker | high | Slopsquatting candidate: sql-walker (npm) |
| VDB-SLOP-npm-230b9efa0b | pkg:npm/cron-schedule-generator | high | Slopsquatting candidate: cron-schedule-generator (npm) |
| VDB-SLOP-npm-581c63371b | pkg:npm/knknex | high | Slopsquatting candidate: knknex (npm) |
| VDB-SLOP-npm-859ea31302 | pkg:npm/@auth0/node-jwt-authentication | high | Slopsquatting candidate: @auth0/node-jwt-authentication (npm) |
| VDB-SLOP-npm-8b2785e971 | pkg:npm/Reconnecting-websocket | high | Slopsquatting candidate: Reconnecting-websocket (npm) |
| VDB-SLOP-npm-1882b4ad5c | pkg:npm/sql-cleaner | high | Slopsquatting candidate: sql-cleaner (npm) |
| VDB-SLOP-npm-341c2899d2 | pkg:npm/hash-SHA256 | high | Slopsquatting candidate: hash-SHA256 (npm) |
| VDB-SLOP-npm-7b13a29350 | pkg:npm/phaserx | high | Slopsquatting candidate: phaserx (npm) |
| VDB-SLOP-npm-42a6edd9ae | pkg:npm/rsa-jwt | high | Slopsquatting candidate: rsa-jwt (npm) |
| VDB-SLOP-npm-a64126a8fa | pkg:npm/BnWebSocket | high | Slopsquatting candidate: BnWebSocket (npm) |
| VDB-SLOP-npm-bce95542f7 | pkg:npm/rp-websocket | high | Slopsquatting candidate: rp-websocket (npm) |
| VDB-SLOP-npm-968da25853 | pkg:npm/These | high | Slopsquatting candidate: These (npm) |
| VDB-SLOP-npm-d964a24d20 | pkg:npm/WebSocketHunter | high | Slopsquatting candidate: WebSocketHunter (npm) |
| VDB-SLOP-npm-a5932df8cc | pkg:npm/cron-collisions | high | Slopsquatting candidate: cron-collisions (npm) |
| VDB-SLOP-npm-9017d6e028 | pkg:npm/sql-inject-san | high | Slopsquatting candidate: sql-inject-san (npm) |
| VDB-SLOP-npm-33751f9a3f | pkg:npm/checksum-verify | high | Slopsquatting candidate: checksum-verify (npm) |
| VDB-SLOP-npm-59d7de093e | pkg:npm/croncollider | high | Slopsquatting candidate: croncollider (npm) |
| VDB-SLOP-npm-88806dd032 | pkg:npm/sql-injection-safe | high | Slopsquatting candidate: sql-injection-safe (npm) |
| VDB-SLOP-npm-ff378d6c5c | pkg:npm/sql-server | high | Slopsquatting candidate: sql-server (npm) |
| VDB-SLOP-npm-111ecd7393 | pkg:npm/@basemaps/ics- | high | Slopsquatting candidate: @basemaps/ics- (npm) |
| VDB-SLOP-npm-367d95b70e | pkg:npm/TeX | high | Slopsquatting candidate: TeX (npm) |
| VDB-SLOP-npm-87029f13cc | pkg:npm/@anthropic-sdk/sdk | high | Slopsquatting candidate: @anthropic-sdk/sdk (npm) |
| VDB-SLOP-npm-2100bab22a | pkg:npm/@fortress-ai/sql | high | Slopsquatting candidate: @fortress-ai/sql (npm) |
| VDB-SLOP-npm-2e3c8d0cac | pkg:npm/immutable-clone | high | Slopsquatting candidate: immutable-clone (npm) |
| VDB-SLOP-npm-3ed55ea5a0 | pkg:npm/cron-util | high | Slopsquatting candidate: cron-util (npm) |
| VDB-SLOP-npm-345e85c4cb | pkg:npm/iCal-parser | high | Slopsquatting candidate: iCal-parser (npm) |
| VDB-SLOP-npm-7dee44c1b0 | pkg:npm/human-cron-parser | high | Slopsquatting candidate: human-cron-parser (npm) |
| VDB-SLOP-npm-781b41980e | pkg:npm/reactivex-websockets | high | Slopsquatting candidate: reactivex-websockets (npm) |
| VDB-SLOP-npm-0c595c6698 | pkg:npm/cronsim | high | Slopsquatting candidate: cronsim (npm) |
| VDB-SLOP-npm-a67252ad29 | pkg:npm/js-sha2 | high | Slopsquatting candidate: js-sha2 (npm) |
| VDB-SLOP-npm-ecd9bb9f3f | pkg:npm/phaserjs | high | Slopsquatting candidate: phaserjs (npm) |
| VDB-SLOP-npm-b5011a138c | pkg:npm/RxJS | high | Slopsquatting candidate: RxJS (npm) |
| VDB-SLOP-npm-132473f9bc | pkg:npm/Not | high | Slopsquatting candidate: Not (npm) |
| VDB-SLOP-npm-263fc06d0e | pkg:npm/knex-sanitizer | high | Slopsquatting candidate: knex-sanitizer (npm) |
| VDB-SLOP-npm-5dd12daea1 | pkg:npm/@prettier/plugin-sql | high | Slopsquatting candidate: @prettier/plugin-sql (npm) |
| VDB-SLOP-npm-3dc340e925 | pkg:npm/cron-requirements | high | Slopsquatting candidate: cron-requirements (npm) |
| VDB-SLOP-npm-b50bd1a10f | pkg:npm/Realtime.co | high | Slopsquatting candidate: Realtime.co (npm) |
| VDB-SLOP-npm-8b5f843932 | pkg:npm/sqlstring-escape | high | Slopsquatting candidate: sqlstring-escape (npm) |
| VDB-SLOP-npm-bc7ffef107 | pkg:npm/parseical | high | Slopsquatting candidate: parseical (npm) |
| VDB-SLOP-npm-b2817efb36 | pkg:npm/ajust | high | Slopsquatting candidate: ajust (npm) |
| VDB-SLOP-npm-11ab2029ed | pkg:npm/faye-websocket- | high | Slopsquatting candidate: faye-websocket- (npm) |
| VDB-SLOP-npm-8a51ebf971 | pkg:npm/xss-sql-sanitizer | high | Slopsquatting candidate: xss-sql-sanitizer (npm) |
| VDB-SLOP-npm-9cf82420ee | pkg:npm/safe-sql-stringify | high | Slopsquatting candidate: safe-sql-stringify (npm) |
| VDB-SLOP-npm-71fa0e3948 | pkg:npm/cron-expire | high | Slopsquatting candidate: cron-expire (npm) |
| VDB-SLOP-npm-81e4a89977 | pkg:npm/cronism | high | Slopsquatting candidate: cronism (npm) |
| VDB-SLOP-npm-56ba5417e2 | pkg:npm/eclipse-paho.websocket | high | Slopsquatting candidate: eclipse-paho.websocket (npm) |
| VDB-SLOP-npm-d07dd70e4b | pkg:npm/cronexpr | high | Slopsquatting candidate: cronexpr (npm) |
| VDB-SLOP-npm-c1d6b5aea8 | pkg:npm/jstimezoned-cron | high | Slopsquatting candidate: jstimezoned-cron (npm) |
| VDB-SLOP-npm-b731e0a5e5 | pkg:npm/sanitize-sql-query | high | Slopsquatting candidate: sanitize-sql-query (npm) |
| VDB-SLOP-npm-f484e65c1e | pkg:npm/@sqltools/parser | high | Slopsquatting candidate: @sqltools/parser (npm) |
| VDB-SLOP-npm-30ddfd159c | pkg:npm/juniper-ms | high | Slopsquatting candidate: juniper-ms (npm) |
| VDB-SLOP-npm-b53192942c | pkg:npm/sql-injection-validator | high | Slopsquatting candidate: sql-injection-validator (npm) |