2026-09-20T23:22:28.549Z
- publishedAt:
Not provided→ 2024-03-28T00:00:00.000Z
SOURCE-LINKED INTELLIGENCE
Purportedly Hallucinated Software Packages with Potential Malware Reportedly Downloaded Thousands of Times by Developers
Large language models have reportedly hallucinated non-existent software package names, some of which were subsequently uploaded to public repositories and incorporated into real codebases. In one case, a package named huggingface-cli, which was purported to have been originally suggested by an AI model, was downloaded more than 15,000 times. This dynamic enables what security researchers have termed "slopsquatting," in which attackers register hallucinated package names and introduce potential malware into software supply chains.
Read original source ↗ Open in workspace
- recordType
- incident-report
- evidenceStatus
- reported
- region
- Global
Reported occurrence date: 2023-12-01T00:00:00.000Z
Evidence & attribution
- AI Incident Database
- AI Incident Database · 2024-03-28T00:00:00.000Z
AI Incident Database, Responsible AI Collaborative; McGregor (2021), Preventing Repeated Real World AI Failures by Cataloging Incidents. Incident-specific contributor credits are available at each citation link. Metadata adapted; article text excluded.
License: CC BY-SA 4.0
First collected: 2026-09-19T22:50:59.123Z. This is not the publication date.
Observed changes
AIIC observation times, not verified publisher revision times. Up to eight recent revisions.