PIR-2026-0007 - Hallucinated "huggingface-cli" package gets 30,000+ real downloads and lands in an Alibaba repo (slopsquatting)

Boundary case: no agent executed anything - AI coding assistants originated a non-existent dependency and humans installed it. Kept per batch-1 convention (boundary cases retained and flagged for definitional review).

id: PIR-2026-0007
title: AI assistants repeatedly hallucinate the PyPI package "huggingface-cli"; a researcher registers it and it draws 30,000+ genuine downloads, including adoption in Alibaba's GraphTranslator README
date_occurred: late 2023 - early 2024 (package registered; ~3-month download window)
date_detected: continuous (researcher-instrumented from registration)
date_disclosed: 2024-03 (Lasso Security research; The Register coverage 2024-03-28)
status: corroborated (researcher account + Alibaba repo artifact + independent coverage; download count is researcher-reported)

The agent

agent_description: Multiple AI coding assistants (LLMs across vendors) that consistently hallucinated pip install huggingface-cli for the real huggingface_hub[cli]. Bar Lanyado (Lasso Security) registered the empty name on PyPI as a benign canary.
operator_type: unknown (many independent developers relying on assistant output)
autonomy_level: human-approves-each-action (humans ran the suggested installs)
model_stack: multiple commercial/open models (Lanyado's study spanned several); versions unknown
harness: n/a (chat/completions usage, no tool execution)

Authority

authority_scope: none directly; the hallucinated dependency reached code execution on installers' machines via human action
funds_at_risk_usd: unknown (a malicious payload would have had arbitrary code execution on 30,000+ installs)
blast_radius: customers/third parties (every installer, plus downstream users of repos that adopted the instruction - incl. Alibaba's GraphTranslator)

The failure

root_cause: plain-error (primary; persistent model hallucination of a plausible package name); contributing operator-error (developers installing unverified dependencies)
failure_locus: dependency (the failure surfaces in the package supply chain, seeded by model output)
exploitation_status: researcher-demonstrated (registration and benign payload were a researcher's; the 30,000+ downloads and Alibaba adoption were organic, in-wild reliance)
mechanism: Models across vendors repeatedly emitted the same non-existent package name - hallucinations are correlated, not random, so one name concentrates thousands of victims. Lanyado registered the empty huggingface-cli on PyPI; in ~3 months it received 30,000+ authentic downloads, and Alibaba's GraphTranslator repo copy-pasted the hallucinated install command into its README, laundering the error into an authoritative source. A malicious squatter would have owned a mass supply-chain compromise. The pattern is now named "slopsquatting."
adversary_present: no (benign researcher occupied the slot an adversary could have)

Impact

severity: near-miss (full exposure of the installer population; zero realized harm because the payload was empty by the researcher's choice, not by any control)
direct_loss_usd: 0
indirect_loss_usd: ~0 (cleanup of the bogus dependency)
downtime: none
data_exposure: none
controls_that_worked: none (no registry, model, or human control blocked the adoption; the near-miss is luck-of-the-squatter)

Detection and recovery

detected_by: third-party (the researcher who instrumented the experiment and disclosed)
time_to_detect: n/a (researcher-observed from day one; the hallucination pattern itself had persisted for months)
time_to_recover: unknown (Alibaba later corrected the README; per-installer cleanup untracked)
remediation: public disclosure; the canary package neutralized the name
structural_fix: none systemic - registries still allow registering hallucination-prone names; the class of attack remains open

Evidence

telemetry_grade: operator-logs (editable) - download counts are PyPI stats as reported by the researcher who owned the package; not independently audited
sources:
- https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/
- https://it.slashdot.org/story/24/03/30/1744209/ai-hallucinated-a-dependency-so-a-cybersecurity-researcher-built-it-as-proof-of-concept-malware (aggregator)
- https://incidentdatabase.ai/cite/731/
- https://en.wikipedia.org/wiki/Slopsquatting
- https://www.aikido.dev/blog/slopsquatting-ai-package-hallucination-attacks
- independence: mechanism and Alibaba adoption corroborated by independent outlets; the 30,000+ figure chains to Lasso's own report.
aiid_incident_id: 731 (https://incidentdatabase.ai/cite/731/) - cross-reference; primaries verified independently
confidence: medium - mechanism and adoption high-confidence; the download count (the headline number) rests solely on the researcher's reporting (the weakest link)

Corrections

2026-08-19: Surfaced the AIID cross-reference already present in this record's sources (cite/731) as the structured aiid_incident_id field (schema v0.3). No claim changed.

Hallucinated "huggingface-cli" package gets 30,000+ real downloads and lands in an…