AI Hallucinates 92% of Recommended npm Packages—Attackers Are Already Registering Them
Have you ever wondered: does the npm package that AI tells you to
npm installactually exist?
On July 8, researchers from Tel Aviv University, Technion (Israel Institute of Technology), and Intuit jointly published a paper proposing a new type of attack called HalluSquatting.
The core finding sent chills down my spine: The average hallucination rate for GitHub repository names recommended by AI coding assistants is as high as 92.4%.
It's not a misspelled package name, nor a confused version number—the entire repository simply does not exist. The AI fabricated the name out of thin air.
And attackers are already exploiting this.
What is HalluSquatting
The full paper title is "Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting". The name is long, but the core idea can be summarized in three sentences:
- AI coding assistants fabricate non-existent package names and repository names (this is the "hallucination" of large language models).
- When the same question is asked repeatedly, the fake names fabricated by AI are surprisingly consistent—there is a 58% probability of fabricating the same name.
- Attackers pre-register these fake names and embed malicious code and prompt injections—lying in wait for developers to take the bait via AI.
You may have heard of typosquatting (domain/package name squatting), where attackers register names similar to well-known packages, such as loadash impersonating lodash.
HalluSquatting is far more vicious: It doesn't need to guess what typos you might make; it directly predicts what names the AI will fabricate. And the prediction accuracy is extremely high.
How the Attack Works
The entire attack chain consists of five steps:
Step 1: Mining "Hallucinated Package Names"
The attacker selects a popular open-source project and repeatedly asks different AI assistants: "Help me clone this project" or "Help me install this tool."
The AI will fabricate a non-existent repository name or package name. Key finding: When different users ask the same question, there is a 58% probability that the AI will fabricate the same fake name.
This means attackers can predict, at scale and automatically, which fake names the AI will recommend.
Step 2: Squatting on Fake Names
The attacker takes these "AI's favorite fabricated names" and registers projects with the same names on GitHub, npm, and PyPI, inserting code that looks normal but hides malicious logic.
Step 3: Implanting Prompt Injection
This is the key difference between HalluSquatting and ordinary supply chain attacks. Attackers don't just place malicious code; they also embed Prompt Injection in README files or code comments—instructions specifically designed to hijack AI Agents.
Once the AI reads this content, it gets "brainwashed" and begins executing operations preset by the attacker.
Step 4: Waiting for the AI to Take the Bait
When a real developer asks the AI: "Help me install this tool," the AI fabricates the same fake name and automatically fetches it from npm/GitHub—what it retrieves is the attacker's malicious version.
Step 5: Infection Spread
The hijacked AI Agent begins executing the attacker's commands: opening reverse shells, stealing passwords and tokens, mining cryptocurrency, and even infecting other AI Agents, forming a botnet.
This is exactly what "Agentic Botnets" in the paper's title refers to—a botnet composed of AI Agents.
How Serious Is It? Numbers from the Paper
The researchers conducted large-scale tests on multiple mainstream AI coding tools:
| Scenario | Hallucination Rate |
|---|---|
| GitHub repositories newly released in 2025 | 92.4% |
| Established GitHub repositories from before 2019 | 0.9% |
| Repository cloning scenario (overall) | Up to 85% |
| Skill/plugin installation scenario | Up to 100% |
A counter-intuitive finding: The newer the project, the more likely the AI is to fabricate a fake name.
For older projects (pre-2019), the hallucination rate is only 0.9% due to sufficient training data. But for projects newly released in 2025, the AI is almost guessing blindly—because these projects are not in its training data, the model can only "guess."
This means: when you ask the AI to help you clone a recently popular new project, the repository address it gives you is highly likely to be fake.
Which Tools Are Affected
The paper tested 9 AI coding tools, with huge disparities in attack success rates:
| Tool | Attack Success Rate | Risk Level |
|---|---|---|
| Cursor | 20-35% | ⚠️ Medium |
| GitHub Copilot | 20-35% | ⚠️ Medium |
| Gemini CLI | 20-35% | ⚠️ Medium |
| Windsurf | 20-35% | ⚠️ Medium |
| Cline | 20-35% | ⚠️ Medium |
| OpenClaw | 80-100% | 🔴 Extremely High |
| ZeroClaw | 80-100% | 🔴 Extremely High |
| NanoClaw | 80-100% | 🔴 Extremely High |
The attack success rate for mainstream commercial tools (Cursor, Copilot, Gemini CLI) is 20-35%—doesn't seem particularly high? Look at it another way: For every 5 packages you ask the AI to install, 1 to 2 could be fake.
For tools based on open-source models (the OpenClaw series), the success rate skyrockets to 80-100%.
Real Case: react-codeshift
This is not a purely theoretical attack.
In January 2026, Charlie Eriksen, a researcher at security firm Aikido Security, discovered a real case: AI coding assistants frequently recommended an npm package called react-codeshift to developers.
The problem is—this package does not exist on npm at all.
It was fabricated by the AI. But Eriksen found that 237 GitHub repositories already contained instructions to install this fake package in their code, all written in AI-generated code.
If someone had preemptively registered react-codeshift on npm and inserted malicious code, all users of these 237 repositories would have been compromised—and they would have no idea they installed a fake package.
This is not an isolated case. In the Nx supply chain attack of August 2025, attackers used AI coding tools to scan developers' cryptocurrency wallets and tokens. In the Axios npm attack of March 2026, the maintainer's token was stolen, and a malicious version was pushed to the official npm source.
AI coding tools are becoming a new entry point for supply chain attacks.
Protection Quick Reference
Bookmark this table and check against it every time the AI recommends installing a new package:
| Check Item | Specific Action | When to Execute |
|---|---|---|
| Verify Package Authenticity | Run npm view <package_name> to confirm the package exists and has downloads |
Every time AI recommends a new package |
| Check Repository Source | Manually search the repository name on GitHub, confirm Stars/Forks/Activity | Every time AI gives you a repository link |
| Review Install Scripts | npm diff <package_name> to view package contents, especially check postinstall scripts |
Every time you add a new dependency |
| Lock Dependency Versions | Commit package-lock.json, enable npm audit |
During project initialization |
| Use Private Registry | Configure a company-level npm private source, only allow whitelisted packages | Mandatory for team projects |
| Disable Auto-Execution | When AI recommends an install command, review first then manually execute; don't let the Agent auto npm install |
All scenarios |
| Continuous Scanning | Integrate socket.dev or snyk into CI/CD to scan the dependency tree |
Every build |
The most important principle: Never let an AI Agent automatically execute npm install without your confirmation.
A single command line can verify:
# Before AI says "npm install xxx", run this first
npm view xxx
# Got a 404? Congratulations, the AI is making up stories.
Final Thoughts
The HalluSquatting paper reveals a problem many developers haven't yet realized: Our trust in AI coding assistants has exceeded what they deserve.
AI can indeed help you write most of your code. But the package names, repository addresses, and install commands it recommends—these outputs that seem the most "certain" are precisely what it is most prone to fabricate. A 92.4% hallucination rate is not a small number.
I'm not saying you should stop using AI coding tools. But at the very least, when it tells you to npm install xxx, spend 10 seconds running npm view xxx.
10 seconds might save you from a reverse shell.
Do you usually check whether the packages AI recommends for installation actually exist? Or do you just copy-paste and install? Tell us your habits in the comments.