# PIR-2026-0007 - Hallucinated "huggingface-cli" package gets 30,000+ real downloads and lands in an Alibaba repo (slopsquatting)

**Boundary case**: no agent executed anything - AI coding assistants originated a non-existent dependency and humans installed it. Kept per batch-1 convention (boundary cases retained and flagged for definitional review).

- `id`: PIR-2026-0007
- `title`: AI assistants repeatedly hallucinate the PyPI package "huggingface-cli"; a researcher registers it and it draws 30,000+ genuine downloads, including adoption in Alibaba's GraphTranslator README
- `date_occurred`: late 2023 - early 2024 (package registered; ~3-month download window)
- `date_detected`: continuous (researcher-instrumented from registration)
- `date_disclosed`: 2024-03 (Lasso Security research; The Register coverage 2024-03-28)
- `status`: corroborated (researcher account + Alibaba repo artifact + independent coverage; download count is researcher-reported)

### The agent
- `agent_description`: Multiple AI coding assistants (LLMs across vendors) that consistently hallucinated `pip install huggingface-cli` for the real `huggingface_hub[cli]`. Bar Lanyado (Lasso Security) registered the empty name on PyPI as a benign canary.
- `operator_type`: unknown (many independent developers relying on assistant output)
- `autonomy_level`: human-approves-each-action (humans ran the suggested installs)
- `model_stack`: multiple commercial/open models (Lanyado's study spanned several); versions unknown
- `harness`: n/a (chat/completions usage, no tool execution)

### Authority
- `authority_scope`: none directly; the hallucinated dependency reached code execution on installers' machines via human action
- `funds_at_risk_usd`: unknown (a malicious payload would have had arbitrary code execution on 30,000+ installs)
- `blast_radius`: customers/third parties (every installer, plus downstream users of repos that adopted the instruction - incl. Alibaba's GraphTranslator)

### The failure
- `root_cause`: plain-error (primary; persistent model hallucination of a plausible package name); contributing operator-error (developers installing unverified dependencies)
- `failure_locus`: dependency (the failure surfaces in the package supply chain, seeded by model output)
- `exploitation_status`: researcher-demonstrated (registration and benign payload were a researcher's; the 30,000+ downloads and Alibaba adoption were organic, in-wild reliance)
- `mechanism`: Models across vendors repeatedly emitted the same non-existent package name - hallucinations are correlated, not random, so one name concentrates thousands of victims. Lanyado registered the empty `huggingface-cli` on PyPI; in ~3 months it received 30,000+ authentic downloads, and Alibaba's GraphTranslator repo copy-pasted the hallucinated install command into its README, laundering the error into an authoritative source. A malicious squatter would have owned a mass supply-chain compromise. The pattern is now named "slopsquatting."
- `adversary_present`: no (benign researcher occupied the slot an adversary could have)

### Impact
- `severity`: near-miss (full exposure of the installer population; zero realized harm because the payload was empty by the researcher's choice, not by any control)
- `direct_loss_usd`: 0
- `indirect_loss_usd`: ~0 (cleanup of the bogus dependency)
- `downtime`: none
- `data_exposure`: none
- `controls_that_worked`: none (no registry, model, or human control blocked the adoption; the near-miss is luck-of-the-squatter)

### Detection and recovery
- `detected_by`: third-party (the researcher who instrumented the experiment and disclosed)
- `time_to_detect`: n/a (researcher-observed from day one; the hallucination pattern itself had persisted for months)
- `time_to_recover`: unknown (Alibaba later corrected the README; per-installer cleanup untracked)
- `remediation`: public disclosure; the canary package neutralized the name
- `structural_fix`: none systemic - registries still allow registering hallucination-prone names; the class of attack remains open

### Evidence
- `telemetry_grade`: operator-logs (editable) - download counts are PyPI stats as reported by the researcher who owned the package; not independently audited
- `sources`:
  - https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/
  - https://it.slashdot.org/story/24/03/30/1744209/ai-hallucinated-a-dependency-so-a-cybersecurity-researcher-built-it-as-proof-of-concept-malware (aggregator)
  - https://incidentdatabase.ai/cite/731/
  - https://en.wikipedia.org/wiki/Slopsquatting
  - https://www.aikido.dev/blog/slopsquatting-ai-package-hallucination-attacks
  - `independence`: mechanism and Alibaba adoption corroborated by independent outlets; the 30,000+ figure chains to Lasso's own report.
- `aiid_incident_id`: 731 (https://incidentdatabase.ai/cite/731/) - cross-reference; primaries verified independently
- `confidence`: medium - mechanism and adoption high-confidence; the download count (the headline number) rests solely on the researcher's reporting (the weakest link)

### Corrections

- 2026-08-19: Surfaced the AIID cross-reference already present in this record's sources (cite/731) as the structured `aiid_incident_id` field (schema v0.3). No claim changed.