LLM package hallucinations enable supply chain attacks through fake code libraries
Researchers found that large language models frequently recommend non-existent open-source packages, and that these hallucinated package names are repeated consistently enough for attackers to exploit them. Security experts warn this creates a supply chain attack vector called 'slopsquatting' where malicious code could be injected into fake packages matching the hallucinated names.
What happened
Researchers from Virginia Tech and the universities of Oklahoma and Texas found that large language models (LLMs) frequently recommend open-source software packages that do not exist. In testing 16 code-generation LLMs with 576,000 Python and JavaScript code samples, approximately one-fifth of recommended packages did not exist, amounting to 205,000 unique hallucinated package names.
The research found that 43% of the same hallucinated packages were suggested repeatedly when re-running identical prompts 10 times each, and 58% were repeated more than once. This consistency in hallucinated package names, combined with their semantic plausibility, creates an opportunity for supply chain attacks known as 'slopsquatting,' where attackers register fake packages with the hallucinated names and inject malicious code into them.
Reported impact
Developers relying on LLMs to write code could unknowingly download and integrate malicious packages into their software. The threat scales significantly if a single hallucinated package becomes widely recommended by multiple AI tools and an attacker has registered that name, potentially enabling widespread compromise across many projects.
Index analysis
The hallucinated packages were described as semantically convincing, making them difficult for developers to distinguish from legitimate libraries by visual inspection. The likelihood of hallucinations increased when LLMs were configured with higher temperature settings designed to produce more random responses.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.