The practical takeaway first: if your team uses AI assistants to generate code with package imports or dependency suggestions, you now have a concrete reason to verify every package name before installation. A technique called "HalluSquatting" turns LLM hallucinations into a botnet recruitment pipeline.
Here's the mechanism. Large language models frequently invent plausible-sounding package names when they don't have a confident answer — rather than admitting uncertainty, they fabricate something that fits the pattern. Attackers have learned to query popular AI coding tools repeatedly, catalog the fake package names those tools consistently hallucinate, and then register those names on real package registries like npm or PyPI. Any developer who follows the AI's suggestion and runs the install command pulls down attacker-controlled code.
Researchers confirmed the attack surface spans nine of the most widely used AI tools. That's not a fringe vulnerability in an obscure model — it covers tools that millions of developers use daily for code generation and debugging assistance. The scale potential is significant: a single malicious package that gets installed across enough developer machines or CI/CD pipelines can seed a substantial botnet or establish persistent access across many organizations simultaneously.
What makes this particularly hard to defend against at the model level is structural. LLMs are trained to produce helpful, fluent output — saying "I don't know this package" runs against the grain of how they're optimized. Vendors can add guardrails, but the underlying pressure toward confident-sounding answers is baked into how these models work.
For builders, the mitigations are concrete. Lock your dependency files and use hash verification. Treat any AI-suggested package name as unverified until you've confirmed it exists on the official registry and has a credible publication history. In automated pipelines, add a step that checks package metadata before installation proceeds. Security teams should also audit which AI tools developers are using for code generation and include hallucinated-dependency scenarios in threat modeling.