Hallusquatting Turns AI Package Hallucinations Into Supply-Chain RCE

Attackers are exploiting AI-generated dependency hallucinations by registering malicious packages under names that coding assistants and autonomous agents invent, a technique known as slopsquatting or hallusquatting. The threat has progressed from a 2023 proof of concept around the nonexistent package huggingface-cli to broader evidence that AI tools repeatedly recommend packages that do not exist; a 2025 academic measurement found 19.7% of AI-suggested Python and JavaScript packages were nonexistent, with many hallucinated names recurring across prompts and models.

The risk escalated in 2026 as hallucinated package names began propagating through agentic development workflows and automated installs. Researchers reported the fake npm package name react-codeshift spreading across 237 repositories, while the malicious package unused-imports continued to be installed, showing how model output can become a software supply-chain infection path. A July 2026 HalluSquatting variant further combined hallucinated resources with prompt injection to drive AI coding agents toward remote code execution (RCE), expanding the attack surface from human typo-based dependency mistakes to model-generated and agent-executed compromise.