Imagine you ask ChatGPT to write some Python code that scrapes a website. It confidently produces working-looking code that starts with import quickscrape. You run pip install quickscrape, and... it works. But quickscrape was never a real package — the model just made up the name. Someone noticed the model does this, registered a package under that name, and stuffed it with malware. You just installed a backdoor.

This attack is called slopsquatting, and it's a real and growing problem. LLMs frequently hallucinate package names that sound plausible but don't exist. Attackers watch what names LLMs invent, then rush to register those names on PyPI or npm with malicious payloads inside. Anyone who copy-pastes the AI's suggestion becomes a victim.

Existing defenses mostly try to catch the problem after the model generates bad output — filtering suggestions, cross-checking against real package registries, or retraining the model from scratch (expensive and slow). This paper takes a different route: model editing.

Model editing is a relatively new technique that lets you surgically modify what an LLM "knows" by directly tweaking specific weights inside the network, rather than retraining. Think of it as microsurgery instead of a heart transplant. The authors identify which internal components of the model are responsible for storing package-name associations, then edit those components so the model becomes reliably aware of which packages actually exist.

Key findings from their work:

• Package hallucinations aren't random — they cluster around plausible-sounding but nonexistent names, exactly the kind attackers can predict and pre-register.
• Targeted edits to a small number of parameters can significantly reduce hallucination rates without harming the model's general coding ability.
• The edits are cheap and repeatable — as new packages get published (or malicious ones get flagged), you can patch the model's "knowledge" incrementally.

The clever insight is that supply-chain security for AI-generated code doesn't have to happen at the output layer or the package registry. It can happen inside the model itself. If the model refuses to confidently emit fake package names, the attack surface shrinks dramatically — attackers can no longer farm hallucinations to squat on.

There are still limits. Editing can introduce subtle side effects, and it can't defend against packages that exist but have been compromised (a different attack). But as a defense against slopsquatting specifically, this changes the economics: instead of playing whack-a-mole with malicious registrations, defenders can plug the leak at the source.