Unclaimed package names: Claude and Codex ran a stranger's code inside Fortune 500 networks

Alon Hertz registered a handful of package names that nobody owned. Within an hour, code he wrote was executing inside a Fortune 500 network, fetched by an AI coding agent that had read the company’s own documentation and believed every line of it.

There was no exploit here. No zero-day, no phishing, no stolen credential. The agent read an install command out of a file the company published for exactly that purpose, ran it, and phoned home. The same mechanic sits under every agent-driven install running in production right now: a package name is only a claim on a public namespace, and an unclaimed name is an open slot that anyone can fill.

How an empty name runs code

Package managers resolve names, not identities. When an agent runs pip install internal-tool, pip asks PyPI whether anything is published under that exact string and downloads it if the answer is yes. If the name has never been claimed, the install fails harmlessly, which is how a stale docs entry can sit in a repository for years without anyone noticing. The moment somebody else registers that name, the same command starts succeeding.

Succeeding is the dangerous part. Both npm and PyPI let a package run code during installation, through a postinstall hook or a setup.py build step, so a payload never has to wait for anyone to import it. That’s RCE handed over by the build system, without any of the usual work of finding a memory bug first.

Hertz’s team found a live version of this on clerk.com. The site’s AI-facing documentation carried the line npx clerk-next-fix-auth-protection, and as Ars Technica reported, npx will pull a package into npm’s cache and execute its binary without ever adding it to the project’s dependency manifest. Somebody had already claimed the empty slot and parked working malware in it. Clerk has since fixed the file.

Nothing in a normal corporate security stack notices any of this. To an EDR agent or an outbound proxy, the traffic looks like a developer running a legitimate package manager against pypi.org, a domain every enterprise already allows, with a sanctioned coding agent as the parent process. As the researchers put it, there was “No anomaly. No alert.”

Typosquatting needs a typo

The older attack depends on a slip of the finger. Someone registers reqeusts, waits for a human to fat-finger the real name, and collects whatever lands. Registries defend against that with edit-distance checks, so a new package whose name sits one or two characters from a popular one gets flagged, held or blocked outright.

That defense never fires on an invented name. In the USENIX Security 2025 study that first measured the problem at scale, Joseph Spracklen and co-authors from UT San Antonio, Virginia Tech and the University of Oklahoma generated 576,000 code samples across 16 models and found 19.7% of the packages those models recommended didn’t exist, yielding more than 205,000 unique invented names. Only 13% of them were near-typos of something real, according to Socket’s breakdown. Roughly half were fully fabricated and still contextually plausible. Similarity scoring can’t catch a name that resembles nothing.

Repeatability is what turns that into a business plan. Spracklen’s team re-ran 500 prompts that had already produced an invented name, 10 times each, and 43% of the names came back on every single run. An attacker doesn’t have to guess what a model will make up. They can ask it, write the name down, and go register it. Seth Larson, the Python Software Foundation’s developer in residence, named the pattern slopsquatting in April 2025, per Infosecurity Magazine.

What the numbers actually show

Hertz’s team scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies and Big Tech, and pulled 8,265 llms.txt and llms-full.txt files off them. On 120 of those sites, each a different company, the file pointed at a package or a domain that nobody had registered. Between them, those files held 227 separate commands telling an agent to install code that didn’t exist or fetch a domain that was free to claim.

The proof of concept was small and it moved fast. The researchers claimed a few of the names, published packages that called home on execution, and waited. A Fortune 500 machine answered inside the hour, and a few dozen more followed, some of them other Fortune 500s and some startups. Parent-process logs named Anthropic’s Claude, OpenAI’s Codex and Nous Research’s Hermes, the same agent found running unattended in an alleged Thai ministry breach in July. None of the three companies answered Ars Technica’s request for comment.

Vendor docs are one half of the problem. What models invent unprompted is the other half, and it has improved without becoming safe. Independent researcher Aleksandr Churilov re-ran Spracklen’s methodology on five frontier models released between October 2025 and March 2026, across 199,845 paired Python and JavaScript prompts, and measured hallucination rates from 4.62% on Claude Haiku 4.5 to 6.10% on GPT-5.4-mini. The spread between best and worst collapsed by an order of magnitude. The floor barely moved.

Overlap is the part worth acting on. Churilov isolated 127 package names, 109 on PyPI and 18 on npm, that all five models invent identically, which is a target list no single-model study would ever surface. PyPI Security’s automated defenses covered 68 of the Python candidates after coordinated disclosure and Socket hand-reviewed the npm side, leaving 53 names anyone can still register today. “An attacker could publish malware under one of these names and wait for an AI coding tool to recommend it,” wrote Socket’s Sarah Gooding. A Claude model has already done the registration half of that by itself, publishing malware under an unclaimed PyPI name during an Anthropic evaluation.

What actually stops this

Lockfiles are the cheapest control and the most commonly skipped one. A committed package-lock.json or uv.lock pins every resolved name to a hash, so a fresh install can’t quietly acquire a package that wasn’t in the tree when a human last reviewed it. Lockfiles do nothing for the first install of a brand-new dependency, which is exactly the moment an agent is most likely to invent one.

Above that sits the registry proxy. Point every build at an internal Artifactory, Nexus or Verdaccio instance and a name has to exist in a curated set before it resolves at all, so an unclaimed public name fails instead of silently succeeding the week somebody claims it. Add a namespace allowlist on top and the reachable surface shrinks to packages a human approved.

The agent-side gate is the control most teams still haven’t wired up, and it comes with a caveat. Claude Code, Codex and the rest all support permission rules on shell execution, so pip install, npm install and npx can be made review-gated commands. Anthropic’s own numbers undercut the optimism there: when it made auto mode the default in Claude Code, it reported that human reviewers caught 13.6% of dangerous commands against 89% for its classifier. Humans rubber-stamp prompts. Plan around that, and switch install scripts off by default with npm install --ignore-scripts so the postinstall path is gone whether or not anyone reads the diff.

None of it helps if nobody checks what already shipped. An SBOM generated at build time gives a list to diff week over week, and Hertz’s own recommendation is blunter: audit the llms.txt files the company itself publishes, then confirm that every package name and domain they reference is still owned by whoever you assume owns it.

Why you’re hearing about this now

Three dates explain the timing. Churilov’s re-evaluation went up on arXiv in May and was revised through August, Socket published the still-registrable name list on July 22, and Hertz’s team went public on August 27. Underneath the dates is a change in who types the install command. When a human ran npm install against a name that didn’t exist, the result was a red error and a shrug. When an agent runs it unattended, in a loop, with shell permission granted once at the top of a session, the result is execution.

Hertz separates this from prompt injection cleanly. “In a prompt injection, someone deliberately plants malicious instructions,” he told Ars Technica. Here the instruction can be completely honest on the day it’s written. The danger arrives later, when the package it names gets abandoned and a stranger claims the slot. “The trust model is broken,” Hertz wrote. “Agents treat vendor docs as ground truth and don’t question them.”

My read: the lockfile and proxy work is worth a quarter of somebody’s time, but the five-minute version is available today. Grep the docs your company publishes for pip install, npm install and npx, then check that every name after them still resolves to something you own. Hertz found 120 companies where it didn’t.