ESL SBOMATOR
Supply Chain Security · 2026

HalluSquatting
Protection

Defending the AI-Powered Development Environment

ESL SBOMator — Innovation in Supply Chain Security

← Swipe to navigate →
ESL SBOMATOR
01 · Emerging Threat

The Threat — What is HalluSquatting?

Adversarial hallucination squatting turns an AI mistake into a supply-chain delivery channel.

Attackers probe LLMs for believable but nonexistent package, repository, or skill names—then pre-register those names with malicious payloads.

Universal leverage: the same hallucinated names recur across foundation models. One squat can work across many AI development tools.
85%

hallucination rate for repository cloning

100%

hallucination rate for skill installations

Exposed development surfaces

CursorWindsurfGitHub CopilotClineGemini CLIOpenClaw
Research: Tel Aviv University, Technion & Intuit · July 2026  [1]
ESL SBOMATOR
02 · Kill Chain

The Attack Chain

1

Trend

Attacker identifies trending resources.

2

Probe

Prompts LLMs to discover recurring hallucinated names.

3

Squat

Pre-registers those names with malicious payloads.

4

Ask

Developer says “clone repo” or “install skill.”

5

Pull

AI hallucinates the squatted name and downloads it.

6

Execute

Built-in terminal runs instructions → RCE → botnet.

Key insight: no direct attacker-to-victim channel is required. The attack is untargeted, persistent, and scales automatically through AI recommendations.
ESL SBOMATOR
03 · Evidence

Real-World Cases

huggingface-cli

30,000+

downloads in three months after Alibaba copied a hallucinated installation command into a README.

react-codeshift

237 repos

Conflated jscodeshift + react-codemod; translated to Japanese and still installed daily by agents.

unused-imports

233 / week

Malicious package downloads driven by AI recommendations.

ccxt-mexc-futures

Credential stealer designed to compromise crypto CI environments.

Montana Empire

AI-assisted phishing kit targeted a phantom domain predicted 23 days earlier.

The pattern

Hallucination → publication → recommendation → trusted execution.

Cases documented by Lasso Security [2], Aikido Security [3], and Palo Alto Unit 42 [4]
ESL SBOMATOR
04 · Research

The Research Landscape

USENIX Security 2025  [5]

16 models · 576,000 samples · 205,474 unique names

19.7%

suggested packages do not exist

43%

repeat consistently

  • 38% conflations · 51% pure fabrications · 13% typo variants
  • 8.7% of Python hallucinations are valid JavaScript packages

Trend Micro  [6]

100 tasks spanning foundation models, coding agents, and MCP-backed vibe coding.

Unit 42  [4]

Phantom Squatting: ~250,000 unregistered hallucinated domains.

SafeDep  [7]

14-hour average detection lead; 1,000+ malicious packages.

Convergent finding

AI-generated names are predictable enough to weaponize—and widespread enough to matter.

Methodology note: risk heuristics and hallucination signals indicate elevated risk—they do not prove a package is malicious. See slides 05–06 for full citations.
ESL SBOMATOR
05 · Academic Research

Academic Research & References

[1] Adversarial HalluSquatting  Preprint

"Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting"

Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, Ben Nassi

Tel Aviv University · Technion · Intuit · July 2026

arXiv preprint (not yet peer-reviewed)

  • Up to 85% hallucination in repo cloning, up to 100% in skill installation
  • RCE in 40–100% of evaluations; transferable across foundation models
  • Demonstrated against Cursor, Windsurf, OpenClaw, NanoClaw, ZeroClaw

arxiv.org/abs/2607.07433 · Project site

[5] Package Hallucination Study  Peer-Reviewed

"We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs"

Joseph Spracklen, Raveen Wijewickrama, A H M Nazmus Sakib, Anindya Maiti, Bimal Viswanath, Murtuza Jadliwala

34th USENIX Security Symposium · August 2025 · Seattle, WA

  • 16 LLMs · 576,000 code samples · 205,474 unique hallucinated names
  • 19.7% of suggested packages do not exist; 43% repeat consistently
  • 5.2% commercial / 21.7% open-source model hallucination rates

arxiv.org/abs/2406.10279 · USENIX

Dataset (MIT) · Zenodo DOI

All links accessed July 2026. [5] is peer-reviewed; [1] is an arXiv preprint and has not undergone formal peer review.
ESL SBOMATOR
06 · Industry & Operational Data

Industry Research & Operational Data

[6] Trend Micro

"Slopsquatting: Hallucination in Coding Agents and Vibe Coding"

Sean Park, Principal Threat Researcher

Industry technical brief · 2025

  • 100 web-development tasks across foundation models, coding agents, and MCP-backed vibe coding
  • Reasoning-enhanced agents reduce hallucinations ~50% but do not eliminate them

Article · Dataset (MIT)

[4] Palo Alto Unit 42

"Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector"

Industry threat research · June 30, 2026

  • 685,339 queries · 913 brands · ~250,000 unregistered hallucinated domains
  • 13,229 confirmed malicious URLs; prediction 18–51 days ahead of registration
  • Montana Empire phishing kit built with AI coding assistant

Full report

[7] SafeDep

Commercial supply-chain security platform with open-source tools (vet, pmg)

  • 14-hour average detection lead over public advisories
  • 1,000+ human-curated malicious package verdicts
  • 20M+ packages scanned continuously

Threat Intel · vet (OSS)

OpenSSF Malicious Packages

Community-reported malicious package disclosures in OSV format. Repository

OSV (Open Source Vulnerabilities)

Unified infrastructure for vulnerability and malicious-package data. osv.dev

Industry reports are not peer-reviewed. Operational datasets are live and continuously updated. [2] Lasso Security — huggingface-cli case; [3] Aikido Security — react-codeshift case. Accessed July 2026.
ESL SBOMATOR
07 · Intelligence

The Data Sources

Tier 1

Monthly · Research seeds

  • Trend Micro slopsquatting GitHub dataset
  • MIT-licensed JSONL
  • USENIX Security 2025 supplementary data
  • 205,000+ unique hallucinated names
Tier 2

Daily · Malicious feeds

  • OpenSSF malicious-packages repository
  • 12,700+ OSV-format reports
  • OSV MAL- entries already in SBOMator
  • GitHub Advisory Database malware records
Tier 3

Real time · Registry APIs

  • PyPI, npm, crates.io live queries
  • Registration age and maintainer history
  • Download counts
  • 24-hour result caching
ESL SBOMATOR
08 · Architecture

Our Solution — SBOMator HalluSquat Protection

HalluSquatChecker

Core multi-heuristic detection engine.

HalluSquatUpdater

Three-tier intelligence orchestrator.

Local SQLite DB

Fast, persistent, offline-capable intelligence.

3 integration surfaces

Scan pipeline · Bumblebee alerts · Databases tab.

✓

“A general feature that runs as an enhancement pass during every scan, with real-time alerts alongside Bumblebee, and data management in the existing Databases tab.”

Integrated—not a separate product or top-level tab.

ESL SBOMATOR
09 · Detection

Five Detection Heuristics

01

Blocklist match

Known hallucinated name from research data. Severity: high

02

Conflation detection

Finds names mashed from real packages: react-codeshift = jscodeshift + react-codemod.

03

Ecosystem mismatch

npm-style name in PyPI—or vice versa. Research shows 8.7% cross-contamination.

04

High-risk ecosystem

Flags agent-skill, MCP, editor-extension, and browser-extension packages.

05

Lifecycle scripts

Detects postInstall hooks, curl/wget/eval/base64, and URL dependencies.

Beyond a blocklist

Signals combine to expose both known squats and novel, previously unseen hallucinations.

ESL SBOMATOR
10 · Pipeline

Scan-Time Integration

generate_sbom() ├── syft/osv-scanner → discover components ├── _enhance_with_cves() ← NVD + KEV ├── _enhance_with_grype() ← Grype ├── _enhance_with_local_osv() ← OSV ├── _enhance_with_hallusquat() ← NEW ├── _scan_with_gitleaks() └── output: SBOM + report

Native report enrichment

Findings appear in CycloneDX:

metadata.vulnerability_analysis.hallusquat_findings

Works with every scan type

ProjectEndpointFirmwareGitHub clone

HalluSquat findings sit alongside CVEs—not in a disconnected report.

ESL SBOMATOR
11 · Runtime Defense

Real-Time Protection with Bumblebee

1

Detect

RealtimeWatcher polls package directories + Windows registry every 30 seconds.

2

Fire event

A newly discovered package produces an “added” event.

3

Evaluate

HalluSquatChecker evaluates the name and ecosystem.

4

Alert

Suspicious items receive a ⚠ alert; clean items remain normal grey.

Critical

Red background in the existing alerts tree.

Warning

Orange background for elevated suspicion.

No new UI

Alerts stay in Endpoint Inventory. Bumblebee already discovers MCP, editor-extension, and agent-skill ecosystems.

ESL SBOMATOR
12 · Operations

Data Management

Databases

🛡 HalluSquat Feed

Alongside NVD · KEV · OSV · Grype

Tier 1

32 seeds

Tier 2

Live feeds

Tier 3

Cached API

Update All Tiers

Status at a glance
Entry counts and last-update timestamps per tier.

Flexible updates
One-click all-tier refresh plus individual tier controls.

Automated upkeep
Uses the existing AutoUpdateSettings pattern.

Transparent intelligence
Built-in documentation for sources and heuristics.

ESL SBOMATOR
13 · Differentiation

What Makes This Unique

Among the first

Built-in HalluSquatting detection at the SBOM layer.

Three-tier intelligence

Research seeds + malicious feeds + live registry evidence.

Integrated

Same CVE/OSV/Grype pipeline and same report.

Real-time + scan-time

Protection at installation and during scheduled scans.

Existing infrastructure

Reuses OSV MAL-, Bumblebee coverage, and auto-update patterns.

Heuristic engine

Conflation, mismatch, lifecycle, and ecosystem signals find novel threats.

Offline-capable: local intelligence remains available; Tier 3 network checks are skipped gracefully.
ESL SBOMATOR
14 · Quality

Verification & Testing

16

regression tests

All passing

11

Checker tests

Blocklist, conflation, mismatch, ecosystem, scripts, enrichment, offline mode.

5

Updater tests

Database init, seed parsing, ZIP parsing, freshness windows.

All existing Bumblebee tests still pass.

Implementation footprint

NEW checker · updater · seed data · 2 test modules

MODIFIED SBOM generator · realtime watcher · endpoint UI · database UI · main window · auto-update service

src/scanners/hallusquat_checker.py src/updaters/hallusquat_updater.py data/hallusquat/seed_research.jsonl tests/test_hallusquat_{checker,updater}.py
ESL SBOMATOR
15 · Conclusion

Key Takeaways

A real, active, growing threat
85–100% hallucination rates; exploitation is already happening.

Integrated SBOM-level defense
Protection follows the component through the supply-chain workflow.

Current intelligence by design
Three tiers update without manual intervention.

Always on
Every scan, plus real-time monitoring alongside Bumblebee.

Minimal new surface area
Reuses NVD/OSV updater, RealtimeWatcher, and enhancement patterns.

Actionable, visible results
One report, one alerts tree, one operational model.

“Trust, but pip freeze”—and now, trust but verify with HalluSquat protection.

ESL SBOMator · Innovation in Supply Chain Security

1 / 16