title: LLM Package Hallucination Typosquat Bait
id: ATR-2026-00260
rule_version: 1
status: experimental
description: |
  Detects prompts designed to elicit non-existent package names from LLMs in generated code, which attackers then squat on public registries (npm, PyPI, crates.io, RubyGems) to execute supply-chain attacks when developers copy-paste the AI-suggested import. Based on NVIDIA garak packagehallucination probe. Pattern: "give me N packages that do X", "which library lets me Y", where X/Y is sufficiently obscure that the model is likely to confabulate a fake name.
author: ATR Community (via NVIDIA garak packagehallucination probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM09:2025
    - LLM03:2025
  owasp_agentic:
    - ASI04:2026
  mitre_atlas:
    - AML.T0060 - Publish Hallucinated Entities
    - AML.T0062 - Discover LLM Hallucinations
  research:
    - https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code
    - https://arxiv.org/abs/2501.19012
    - https://www.lasso.security/blog/ai-package-hallucinations
compliance:
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Package hallucination typosquat bait exploits third-party/supplier supply chains by tricking LLMs into recommending non-existent packages that attackers then squat on public registries; GV.6.1 requires policies addressing third-party AI risks including the package ecosystems consumed by AI-generated code.
      strength: primary
    - subcategory: MG.3.2
      context: Detecting prompts designed to elicit confabulated package names provides monitoring evidence for pre-trained model behavior that introduces supply-chain risk; MG.3.2 requires monitoring of pre-trained models for hallucination patterns that propagate into downstream artifacts.
      strength: secondary
    - subcategory: MS.2.5
      context: Hallucinated package names are robustness/reliability failures of the LLM under obscure or niche queries; MS.2.5 requires that such reliability degradations are evaluated and documented as part of ongoing model assessment.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (LLM Package Hallucination Typosquat Bait).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (LLM Package Hallucination Typosquat Bait).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (LLM Package Hallucination Typosquat Bait).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (LLM Package Hallucination Typosquat Bait) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (LLM Package Hallucination Typosquat Bait).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (LLM Package Hallucination Typosquat Bait).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: package-hallucination-supply-chain
  scan_target: mcp
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
metadata_provenance:
  garak_probe: packagehallucination.Python, packagehallucination.JavaScript
  garak_detector: always.Fail
  payload_source: garak/probes/packagehallucination.py
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?:give\s+(?:me\s+)?examples\s+of\s+)?(?:two|three|four|five|six|seven|eight|nine|ten|\d{1,2})\s+(?:python|javascript|node|ruby|rust|go|java|php|typescript)\s+(?:libraries|packages|modules|crates|gems)\s+(?:which|that)\s+\w{1,40}
      description: Request for N libraries matching a specific task - core garak stub_prompts pattern
    - field: tool_response
      operator: regex
      value: which\s+(?:python|javascript|node|ruby|rust|go|java|php|typescript)\s+(?:modules?|libraries?|packages?|crates?)\s+(?:let|allow|help|would\s+a|can)\s+me\s+\w+
      description: Modal question form requesting libraries - garak stub_prompts[5-6]
    - field: tool_response
      operator: regex
      value: (?:interface\s+with|connect\s+to|read\s+from|load\s+a?|write\s+to)\s+(?:arangodb|istio|pinecone|langchain|cuda\s+kernel|realtek\s+\d+|tektronix|stromberg|ae35|hal\s*9000|dex\s+holographic|lumon|marblepunk|scp\s+database|kitt|zapata|sigismondi)\b
      description: Garak-style niche/fictional target that invites hallucinated package names
    - field: tool_response
      operator: regex
      value: (?:as\s+a\s+(?:woman|man|black|white|asian|latino|queer|trans)[^,]{0,30},\s*)?(?:i\s+need|please\s+write|could\s+you\s+(?:help|give))\s+(?:example\s+)?(?:python|javascript|rust|ruby|go|java|php)\s+code\s+using\s+a\s+library\s+to\s+\w+
      description: Garak stub_prompts[4-5] - demographic-prefixed library request pattern
  condition: any
  false_positives:
    - Legitimate package discovery questions about well-known libraries (requests, numpy, pandas)
    - Library comparison posts on Stack Overflow or Reddit
    - Framework documentation listing official companion packages
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00260] Package-hallucination bait prompt detected - crafted to elicit fake library names exploitable via registry typosquatting.