AI Hallucinates 92% of Recommended npm Packages—Attackers Are Already Registering Them
AI coding assistants have become a new supply-chain entry point. A developer who blindly runs `npm install` on an AI-suggested package is effectively downloading attacker-controlled code, and the agent itself can be turned into a persistent threat. The 20–35% success rate on Cursor and Copilot means roughly one in every three to five AI-recommended packages could be a trap.
Researchers from Tel Aviv University, Technion, and Intuit documented a supply-chain attack that weaponizes LLM hallucinations. When developers ask AI assistants to install or clone a project, the model fabricates a non-existent package name 92.4% of the time for repositories created after 2024. The same fake name reappears across different users 58% of the time, making the hallucination predictable at scale.
Attackers mine these recurring fake names, register them on npm, PyPI, or GitHub, and seed the repositories with malicious code plus prompt-injection payloads in README files and comments. When a developer's AI agent fetches the package, the injection hijacks the agent itself, turning it into a node in a botnet that steals credentials, opens reverse shells, or mines cryptocurrency.
Mainstream tools like Cursor and Copilot show a 20–35% attack success rate, while open-source-model-based tools like OpenClaw reach 80–100%. A real-world case already surfaced: the npm package `react-codeshift`, entirely AI-fabricated, appeared in install instructions across 237 GitHub repositories. The fix is a 10-second `npm view <name>` check before running any AI-suggested install command.
The hallucination rate is inversely correlated with how much training data exists for a project, which means the attack surface grows as the ecosystem moves faster than model retraining cycles.
Prompt injection embedded in package metadata turns a one-time supply-chain compromise into a persistent agent hijack, a qualitatively different threat from a malicious dependency alone.
The 58% cross-user consistency of hallucinated names suggests the models are not generating random strings but are converging on plausible-sounding patterns that attackers can systematically mine.
Commercial tools' lower success rate (20–35%) compared to open-source agents (80–100%) implies that RLHF and safety tuning provide partial but incomplete mitigation.