HalluSquatting weaponizes the model's own hallucinations.

Attackers pre-register the fake package names an agent is statistically likely to invent, so when your coding assistant hallucinates a dependency, it installs attacker-controlled botnet malware. No prompt injection needed. The attacker just anticipates the model's errors and waits. This turns "slopsquatting" into an active supply-chain threat. Backing it: Unit 42 counted 497 malicious npm packages across 37 campaigns in H1 2026, about 4.5x last year's volume, with AI-agent packages the prime target because they sit next to API keys. Pin dependencies. Verify every package name an agent suggests actually exists before install.