Hallucinated Package Names Become a New Infection Path
LLM coding agents can be turned into a scalable infection channel when they guess missing package or repo names and then fetch whatever exists under that name. The break is not the prompt text itself. It is the tool’s habit of trusting its own guess and treating a predicted identifier as legitimate.
The reported HalluSquatting technique pre-registers the identifiers models are likely to invent, then seeds them with malicious installer code. Ars Technica says the technique affects popular assistants and agents including Cursor, Cursor CLI, Gemini CLI, Windsurf, GitHub Copilot, Cline, OpenClaw, ZeroClaw, and NanoClaw, all of which routinely resolve and run third-party resources during normal use.
That makes automatic dependency retrieval the danger point. If a coding agent can resolve, fetch, and execute packages from repositories or registries, the compromise can spread without a victim clicking anything, and standard prompt-injection defenses miss the real entry path.