AI Security Atlas › All entries › Model Supply Chain & Training Integrity
Hallucinated Package Squatting
Attackers register package names that coding assistants hallucinate, so developers or agents that install the suggestion pull in malware.
Open in the interactive atlas →Impact
Malicious code runs on developer machines and in CI with access to source and secrets.
Why this severity
Impact High × Likelihood Medium = High
Impact high: code execution in development and CI. Likelihood medium: package hallucination is measured in research and demonstrated, but installing the suggestion is still required.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Demonstration: ChatGPT Package Hallucination (MITRE ATLAS case study AML.CS0022, 2024)
- Research: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (arXiv 2406.10279, 2024)
Related
Exploits
- Unreviewed AI-Suggested Code & Dependencies Vulnerability · High severity
- Unverified Data & Model Provenance Vulnerability · High severity
Mitigated by
- Dependency Allowlisting & Package Verification Guardrail · Fixes high risks
Remediation
- Install only from an allowlist or internal mirror.
- Check package age, maintainers, and download history before first use.
- Block agents from installing packages without approval.
How to verify
- Ask assistants for packages in an internal benchmark and confirm unknown names are blocked.
- CI fails on dependencies outside the allowlist.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM09:2025 Misinformation
- LLM03:2025 Supply Chain
OWASP Top 10 for Agentic Applications 2026
- ASI04:2026 Agentic Supply Chain Vulnerabilities
MITRE ATLAS
NIST AI RMF 1.0
- MAP 4.1 Risks of AI components, including third-party data and software, are mapped