Developer nearly installed a suspicious AI-suggested package

A developer at Softjourn, a software consulting firm, nearly installed a package that an AI coding agent had recommended for a routine task. Before installing, the developer noticed the package had very few downloads and had been created only a few days earlier, and stopped.

Softjourn's managing director, Sergiy Fitsak, described the incident in August. The team's practice is to check download counts and read a package's source on GitHub before installing anything an AI tool recommends.

What is not known: neither the agent nor the package has been named, and the package's payload was never confirmed. Softjourn's view is that it could have opened a backdoor, but nobody has shown it was malicious.

The pattern Fitsak points to has a name, slopsquatting. Models sometimes invent package names that sound plausible but don't exist, and attackers can register those names in public registries ahead of the next developer who gets the same suggestion. The risk is measurable. A study of 576,000 code samples from 16 models, presented at USENIX Security 2025, found that at least 5.2% of recommended packages from commercial models and 21.7% from open-source models didn't exist, across 205,474 unique invented names.

The check is cheap. Before installing a package an agent suggests, look at its age, download count, maintainer and repository, and be most suspicious of a name you haven't seen before. In Fitsak's words: "It takes a few extra minutes. Skipping that step once is how a team ends up explaining a supply chain compromise."

Correction, October 22, 2026: an earlier version of this item said the package was malware and quoted Sergiy Fitsak with words he didn't say. The package was never confirmed malicious, and the quote has been corrected.