Checking whether an npm package "exists" stopped working A developer found that npm package existence checks are no longer effective against AI-hallucinated package names, which are being registered by attackers in a practice called 'slopsquatting'. The developer built a tool called 'vetdeps' that uses reputation-based checks and measured rules against real packages to achieve zero false positives. The tool also detected that 'unused-imports' and 'types-node' were confirmed malware. Every npm supply chain postmortem ends with the same advice: verify the package before you install it. So I looked at what the tools that do this actually check. Most of them check whether the package exists. That check is dead. Here are three package names documented as AI hallucinations, against the npm registry right now: react-codeshift HTTP 200 react-fetch-hook HTTP 200 unused-imports HTTP 200 All three exist. Somebody registered them. Every guard built on an existence check reports them safe . AI coding tools suggest package names that do not exist about 19.7% of the time, measured across a 576,000 sample study. More usefully for an attacker, 43% of those hallucinated names repeat across identical prompts. That is the whole attack. The hallucinations are predictable, so you register the common ones and wait for someone to paste an install command. It has a name now: slopsquatting. And in 2026 the thing typing npm install is often an agent that never pauses to sanity check a name at all. Not existence. Reputation. | Package | First published | Downloads/week | |---|---|---| react-codeshift | 2026-01-14 | 1 | unused-imports | 2025-10-27 | 201 | eslint-plugin-unused-imports | 2019-09-18 | 7,780,771 | react-fetch-hook | 2018-12-18 | 15,329 | Look at that last row, because it is the hard part. react-fetch-hook sounds completely invented. It is seven years old, has 15,000 weekly downloads, and is entirely legitimate. Any rule of the form "new or odd-sounding name equals bad" flags it immediately. And a security tool that flags a legitimate package gets uninstalled the same day. False positives are not a tuning problem, they are the product failing. This surprised me most. unused-imports and eslint-plugin-unused-imports are fifteen edits apart . Every typosquat checker built on Levenshtein distance sails straight past the single most common real case. The rule that actually catches it is different: Does the candidate, plus a known ecosystem prefix, equal a popular package? unused-imports + eslint-plugin- = a package with 7.8 million weekly downloads. That is exactly the shape an LLM produces when it drops the ecosystem prefix, which it does constantly. I measured every rule against real packages before shipping. Two of them were wrong, and I would never have reasoned my way to either. A fixed edit distance of 2 flagged znv as a typo of ajv. Both real, both legitimate. Short names sit naturally close to each other, so a fixed threshold is meaningless on them. Allowed distance now scales with name length: under 5 characters requires an exact match. Affix rules that stripped a suffix flagged chalk-cli as chalk. chalk-cli is Sindre Sorhus's official CLI, published 2015. It also flagged vite-plugin-vue as vue . Of course it did: