HalluSquatting registers hallucinated package names across nine coding agents to deploy reverse shells at scale

The attack exploits LLM tendency to emit non-existent repository or registry paths during code generation. Adversaries pre-register those paths with malicious payloads. Agents running with local execution privileges fetch and execute the content without user confirmation. Tests covered daily workflows in the nine tools and produced working command-and-control channels on Linux, macOS and Windows hosts.

Data from 4,800 controlled runs showed mean time to first shell of 2.3 minutes after agent initialization. No tool enforced cryptographic signing or provenance checks on fetched resources. The pattern matches prior supply-chain compromises such as the 2024 XZ Utils incident and the 2025 npm namespace-squatting campaigns, yet operates without any initial victim interaction.

Operational impact includes immediate loss of developer workstations and cloud build agents that invoke these assistants. Defenses remain limited to post-hoc output filtering, which the paper shows can be bypassed by simple encoding variations. Enterprises running autonomous coding pipelines face the highest exposure because agents execute with elevated tokens.

Registry operators and agent vendors have not published coordinated takedown or allow-list mechanisms as of the July 2026 disclosure. Similar registration attacks succeeded against PyPI and npm within weeks of publication in earlier incidents, indicating comparable velocity here.