Package Hallucination Exploitation — AI-Suggested Fake Package Installation - ATR-2026-00513 (29833306-dc77-541a-905f-40cca43fb5f4)
Detects requests that exploit AI-hallucinated package names that attackers have pre-registered as malicious packages (supply-chain squatting on hallucinations). OWASP LLM09:2025 Misinformation + LLM03:2025 Supply Chain. MITRE ATLAS AML.CS0022 (ChatGPT Package Hallucination). Attack pattern: user attributes a package name to an AI/LLM recommendation ("the AI suggested", "GPT recommended", "ChatGPT mentioned") combined with an install intent verb, enabling an attacker who has registered the hallucinated name to deliver malware. Also detects hallucination-typical naming patterns (model-name + common-lib + extras/secure/helper/tools/wrapper suffixes) combined with install intent and AI attribution.