From Hallucination to Registration: Do the Package Names That LLMs Invent Actually Get Claimed?

Large language models routinely invent software package names that do not exist. The security concern, called slopsquatting, is that an attacker registers one of these hallucinated names and waits for a developer, or an AI coding agent, to install it on a model's recommendation. Prior work measures how often models hallucinate. We measure what happens next: of the names models invent, how many are actually registered on the package index, and by whom? Using five open-weight code models we generate 6,800 samples and extract 1,641 distinct invented names that are confirmed absent from the registry; the invented-name space does not saturate. We then ask who has claimed them. Re-checking all 1,641 live, every one is still unregistered (a 95% upper bound below 0.2% on the fraction claimed by anyone), so the names an attacker would have to invent independently sit unclaimed. Separately, from public datasets of previously reported hallucinated names, we take 149 that have circulated long enough to attract registration; 22 are registered, and adjudicating each by true registration date and static content inspection, zero are malicious (a 95% upper bound of roughly 14% on the registered-name malice fraction), with 19 of the 22 traced to a single anonymous benign-placeholder operation and the other three (an organic collision, an individual reservation, and a 2019 pre-AI typosquat) unrelated to slopsquatting. We also confirm the install-to-execution primitive in a sealed offline lab using only our own benign package. The picture in this data: exposure is large and growing, but claiming is essentially absent, and the hallucinated names that do get claimed are, so far, benign rather than weaponized. We are explicit that the 149-name census is drawn from public lists that defenders preferentially scrape, and is a small registered sample. We release the code, the frozen snapshot hashes, and aggregate statistics, and we withhold the raw name list to avoid handing attackers a target menu.