functools-utils

⚠️ RESEARCH ONLY — NOT A REAL UTILITY PACKAGE

This package is an artifact of the VersionSpecGuard research study on LLM package hallucination ("slopsquatting"). It provides no functionality. It exists only to validate the slopsquatting attack kill chain described in the accompanying paper.

What this package is

LLM coding assistants occasionally recommend functools-utils when asked about Python utilities — but no such library existed before this package. We registered the name to demonstrate that the attack surface LLMs hallucinate is real and registrable.

What this package does

On import functools_utils, it writes a single research marker line to stderr. That's all.

[VSG-SLOPSQUATTING-POC] research marker: imported functools-utils at 2026-07-22T... pid=...

What this package does NOT do

• ❌ Makes no network requests (no HTTP, no DNS, no sockets)
• ❌ Reads no files
• ❌ Reads no environment variables
• ❌ Collects no data of any kind

The full source is a single 40-line file — anyone can audit it in 30 seconds.

Why does this exist?

If an AI coding assistant recommended pip install functools-utils, you were given a hallucinated suggestion. The name "functools-utils" looks plausible — it resembles stdlib functools plus a -utils suffix — but there was never any such library. An attacker who registers such names can get arbitrary code executed on developer machines when those hallucinated recommendations are copy-pasted.

This package demonstrates the registration phase is feasible. It does NOT demonstrate exploitation — it contains no payload.

If you arrived here from an LLM recommendation

1. Report the hallucination to the LLM provider (OpenAI, Anthropic, DeepSeek, GLM, etc.) via their feedback channels.
2. You don't need this package — uninstall it:

   pip uninstall functools-utils
   

3. See the research paper for context: Slopsquatting on the 2026 Frontier (authors redacted for double-blind review).

Contact

• Email: research@example.com (replace with real contact before upload)
• Paper: Slopsquatting on the 2026 Frontier (link TBD)

License

MIT