Package Hallucinations as Phantoms in Open-source Software Supply Chains: An Empirical Security Analysis

Abstract

In code generation tasks, large language models (LLMs) frequently recommend nonexistent software packages, referred to as package hallucinations. This may pose a security risk, as attackers could register these fake packages and exploit them in supply chain attacks. To investigate the real-world feasibility, this paper conducts a systematic empirical study of this potential threat. We extracted 107 hallucinated packages from eight prominent LLMs and uploaded them to the npm registry over six months. The results demonstrate a tangible risk: 35.2% of package installations are attributed to developers, with most initial interactions occurring within a two-week window post-registration. A name similarity analysis further reveals that 25.2% of hallucinated names fall within an absolute edit distance of \(\leq\) 1 from existing npm packages, posing a direct typosquatting risk. In our evaluated setting, tool-augmented generation, specifically using web search, fails to mitigate this threat. Instead, it significantly amplifies hallucination persistence from 11.2% to 17.3% through context contamination. In the npm registry, the entire attack campaign costs only an estimated $496, making it far more accessible than traditional supply chain attacks yet capable of enabling poisoning effects. To mitigate this emergent threat, we design an autonomous defense agent: NymGuard. It provides a proactive defense by automating the real-time detection of hallucinated packages, their preemptive registration to block malicious use and the maintenance of a public warning registry. The full implementation has been open-sourced and is available on GitHub (https://github.com/xiaoye798/Package-Hallucination-Research).