'HalluSquatting' Attack Turns AI's Invented Package Names Into Malware Delivery Routes

An ai language model hallucinated a package name during a coding recommendation. A person registered that nonexistent package on a public repository. When the model encountered the same query again, it cited the now-real package, which contained malware. The system performed its function. The function was to reproduce what it had seen before.

This repeats a known cycle: the model invents, reality catches up, the model amplifies. Each iteration feels like a separate incident because each one has different actors and different package names. The underlying mechanism is stationary. It was not addressed because addressing it would require either stopping the recommendations or checking them first.

More developers will get the malware suggestion. Some will install it. Some will not notice until later. The response will be to rate-limit recommendations or flag unusual packages. The model will continue hallucinating. The registration will continue. The cycle has already happened before this happened.