跪拜 Guibai
← All articles
Frontend · JavaScript · AI Programming

AI Hallucinates 92% of Recommended npm Packages—Attackers Are Already Registering Them

By kyriewen ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

AI coding assistants have become a new supply-chain entry point. A developer who blindly runs `npm install` on an AI-suggested package is effectively downloading attacker-controlled code, and the agent itself can be turned into a persistent threat. The 20–35% success rate on Cursor and Copilot means roughly one in every three to five AI-recommended packages could be a trap.

Summary

Researchers from Tel Aviv University, Technion, and Intuit documented a supply-chain attack that weaponizes LLM hallucinations. When developers ask AI assistants to install or clone a project, the model fabricates a non-existent package name 92.4% of the time for repositories created after 2024. The same fake name reappears across different users 58% of the time, making the hallucination predictable at scale.

Attackers mine these recurring fake names, register them on npm, PyPI, or GitHub, and seed the repositories with malicious code plus prompt-injection payloads in README files and comments. When a developer's AI agent fetches the package, the injection hijacks the agent itself, turning it into a node in a botnet that steals credentials, opens reverse shells, or mines cryptocurrency.

Mainstream tools like Cursor and Copilot show a 20–35% attack success rate, while open-source-model-based tools like OpenClaw reach 80–100%. A real-world case already surfaced: the npm package `react-codeshift`, entirely AI-fabricated, appeared in install instructions across 237 GitHub repositories. The fix is a 10-second `npm view <name>` check before running any AI-suggested install command.

Takeaways
AI coding assistants hallucinate GitHub repository and npm package names at a 92.4% rate for projects released in 2025, compared to 0.9% for pre-2019 projects.
The same hallucinated name recurs across different users 58% of the time, letting attackers predict and pre-register those names.
Attackers combine malicious code with prompt-injection payloads in README files, so the victim's AI agent itself gets hijacked after fetching the package.
Mainstream tools (Cursor, Copilot, Gemini CLI) have a 20–35% attack success rate; open-source-model tools like OpenClaw hit 80–100%.
The fabricated npm package `react-codeshift` already appeared in install instructions across 237 real GitHub repositories.
Running `npm view <package-name>` before any AI-suggested install catches non-existent packages immediately with a 404.
Never allow an AI agent to auto-execute `npm install` without manual review.
Conclusions

The hallucination rate is inversely correlated with how much training data exists for a project, which means the attack surface grows as the ecosystem moves faster than model retraining cycles.

Prompt injection embedded in package metadata turns a one-time supply-chain compromise into a persistent agent hijack, a qualitatively different threat from a malicious dependency alone.

The 58% cross-user consistency of hallucinated names suggests the models are not generating random strings but are converging on plausible-sounding patterns that attackers can systematically mine.

Commercial tools' lower success rate (20–35%) compared to open-source agents (80–100%) implies that RLHF and safety tuning provide partial but incomplete mitigation.

Concepts & terms
HalluSquatting
An attack that exploits LLM hallucinations by predicting the fake package or repository names an AI assistant will fabricate, then pre-registering those names with malicious code and prompt injections.
Prompt Injection
A technique where attacker-controlled text (e.g., in a README or code comment) contains instructions that hijack an AI agent's behavior, causing it to execute unintended actions like exfiltrating data or running shell commands.
Agentic Botnet
A network of compromised AI coding agents that have been hijacked via prompt injection and can be remotely commanded to perform malicious tasks such as cryptomining, credential theft, or further propagation.
Typosquatting
A traditional supply-chain attack where an attacker registers a package name that is a common misspelling of a popular package (e.g., `loadash` for `lodash`), hoping developers will install it by mistake.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗