A hallucinated package name creates a supply-chain attack opportunity if an attacker publishes malicious code under that invented name.

Format Web Page

Location PART 1 - TONS OF PUNKS, ONE BIG JERK CHAPTER 2: NO MOAT IN BLOAT Bug Hunt or Witch Hunt?

"A hallucinated package name creates a supply-chain attack opportunity if an attacker publishes malicious code under that invented name."

USENIX describes an attack path in which an attacker registers a hallucinated dependency name and a later user risks installing the malicious package.

View Source

Source title Package Hallucinations: How LLMs Can Invent Vulnerabilities

Source authors Joseph Spracklen, Raveen Wijewickrama, A H M Nazmus Sakib, Anindya Maiti, Bimal Viswanath, Murtuza Jadliwala

Source year 2025

Confidence high

Importance high