VDB: 83 of 87 AI-hallucinated package names are unclaimed, exposing slopsquatting risk

VDB re-checked the 100 highest-risk package names recommended by Claude, GPT and Gemini: 87 passed registry naming rules, all 87 returned 404, and 83 belong to nobody and can be registered by anyone. This leaves the door open to slopsquatting, where an attacker claims a hallucinated name and ships malicious code to the next developer or coding agent.

• 13 of 100 names were dropped: 8 were real npm packages with wrong casing, 5 were not names
• 83 unclaimed names: 39 on npm, 42 on PyPI, 1 Go module, 1 crate
• Names cluster by task: CycloneDX 14, JWT 12, YAML 8, iCalendar 8
• Collection runs every 6 hours: 30 coding tasks sent to Claude, GPT and Gemini, each name checked in its registry