New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware

AI coding assistants have a habit of making things up. Ask one to fetch a popular tool, and it will sometimes hand back a real-sounding name for a project that does not exist. New research, which its authors call HalluSquatting, turns that habit into an attack: work out the fake names an AI reliably invents, register them first, and wait for the assistant to fetch your trap on a user's

The reported HalluSquatting attack targets AI coding assistants that hallucinate non-existent software packages and then suggest them to developers as legitimate dependencies.[1][8] Researchers show that attackers can pre-register these AI-invented package names in public registries (e.g., npm, PyPI), embed malware such as botnet installers, and then wait for AI tools to recommend and developers to install them, effectively turning AI hallucinations into a software supply chain compromise path.[1][6][8] RealGround’s analysis: This is a direct AI supply chain risk, because it exploits LLM-driven dependency selection rather than traditional typo-squatting, and it can silently introduce malicious packages into build pipelines and production systems at scale. Organizations should add AI-aware dependency controls (e.g., blocking or flagging newly registered or low-reputation packages suggested by AI, tightening SBOM and package provenance checks, and updating secure coding policies to govern AI assistant use) and conduct targeted reviews of AI-driven dependency installation workflows.