The DOI matches its DataCite record; 2 of the 2 references it cites were found in a registry or an index.
We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
Open accessAbstract
The reliance of popular programming languages such as Python and JavaScript on centralized package repositories and open-source software, combined with the emergence of code-generating Large Language Models (LLMs), has created a new type of threat to the software supply chain: package hallucinations. These hallucinations, which arise from fact-conflicting errors when generating code using LLMs, represent a novel form of package confusion attack that poses a critical threat to the integrity of the software supply chain. This paper conducts a rigorous and comprehensive evaluation of package hallucinations across different programming languages, settings, and parameters, exploring how a diverse set of models and configurations affect the likelihood of generating erroneous package recommendations and identifying the root causes of this phenomenon. Using 16 popular LLMs for code generation and two unique prompt datasets, we generate 576,000 code samples in two programming languages that we analyze for package hallucinations. Our findings reveal that that the average percentage of hallucinated packages is at least 5.2% for commercial models and 21.7% for open-source models, including a staggering 205,474 unique examples of hallucinated package names, further underscoring the severity and pervasiveness of this threat. To overcome this problem, we implement several hallucination mitigation strategies and show that they are able to significantly reduce the number of package hallucinations while maintaining code quality. Our experiments and findings highlight package hallucinations as a persistent and systemic phenomenon while using state-of-the-art LLMs for code generation, and a significant challenge which deserves the research community's urgent attention.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“For example, instead of downloading a malicious software package directly, a code agent could simply add an import for this package in the code and hope that the end-user will download the package when compilation fails (Spracklen et al., 2024).”
From Design Patterns for Securing LLM Agents against Prompt Injections (2025) · cites this paper as Spracklen et al., 2024
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 48
- Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shya- mal Anadkat, et al. Gpt-4 technical report. arXiv:2303.08774, 2023. · arXiv
- Renat Aksitov, Chung-Ching Chang, David Reitter, Sia- mak Shakeri, and Yunhsuan Sung. Characterizing at- tribution and fluency tradeoffs for retrieval-augmented large language models. arXiv:2302.05578, 2023. · arXiv
- Tom Brown, Benjamin Mann, Nick Ryder, Melanie Sub- biah, Jared D Kaplan, Prafulla Dhariwal, Arvind Nee- lakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. NIPS, 33:1877-1901, 2020.
- Haw-Shiuan Chang and Andrew McCallum. Softmax bottleneck makes language models unable to represent multi-mode word distributions. In ACL, 2022.
- Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evaluating large language models trained on code. arXiv:2107.03374, 2021. · arXiv
- Xiuying Chen, Mingzhe Li, Xin Gao, and Xiangliang Zhang. Towards improving faithfulness in abstractive summarization. NIPS, 2022.
- Nouha Dziri, Andrea Madotto, Osmar Zaïane, and Avishek Joey Bose. Neural path hunter: Reducing hal- lucination in dialogue systems via path grounding. In EMNLP, 2021.
- Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. OPTQ: Accurate quantization for generative pre-trained transformers. In ICLR, 2023.
- Isabel O Gallegos, Ryan A Rossi, Joe Barrow, Md Mehrab Tanjim, Sungchul Kim, Franck Dernon- court, Tong Yu, Ruiyi Zhang, and Nesreen K Ahmed. Bias and fairness in large language models: A survey. arXiv:2309.00770, 2023. · arXiv
- Daya Guo, Qihao Zhu, Dejian Yang, Zhenda Xie, Kai Dong, Wentao Zhang, Guanting Chen, Xiao Bi, Y Wu, YK Li, et al. Deepseek-coder: When the large language model meets programming-the rise of code intelligence. arXiv:2401.14196, 2024. · arXiv
- Julian Hazell. Spear phishing with large language mod- els. arXiv:2305.06972, 2023. · arXiv
- Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. In ICLR, 2020.
- Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Wei- hua Peng, Xiaocheng Feng, Bing Qin, et al. A sur- vey on hallucination in large language models: Princi- ples, taxonomy, challenges, and open questions. arXiv preprint:2311.05232, 2023. · arXiv
- Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Wei- hua Peng, Xiaocheng Feng, Bing Qin, et al. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. arXiv:2311.05232, 2023. · arXiv
- Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Computing Surveys, 2023.
- Ziwei Ji, Zihan Liu, Nayeon Lee, Tiezheng Yu, Bryan Wilie, Min Zeng, and Pascale Fung. RHO: Reducing hallucination in open-domain dialogues with knowledge grounding. In ACL, 2023.
- Ziwei Ji, Tiezheng Yu, Yan Xu, Nayeon Lee, Etsuko Ishii, and Pascale Fung. Towards mitigating LLM hal- lucination via self reflection. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, EMNLP, 2023.
- Albert Q Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bamford, De- vendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, et al. Mixtral of experts. arXiv:2401.04088, 2024. · arXiv
- Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of llms: Dual-use through stan- dard security attacks. arXiv preprint:2302.05733, 2023. · arXiv
- Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks. NIPS, 2020.
- Chenliang Li, Bin Bi, Ming Yan, Wei Wang, and Song- fang Huang. Addressing semantic drift in generative question answering with auxiliary extraction. In ACL- IJCNLP, 2021.
- Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. Multi-step jailbreaking privacy attacks on chatGPT. In EMNLP, 2023.
- Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfis- ter, and Martin Wattenberg. Inference-time intervention: Eliciting truthful answers from a language model. NIPS, 2024.
- Jenny T Liang, Chenyang Yang, and Brad A Myers. A large-scale survey on the usability of ai programming assistants: Successes and challenges. In ICSE, 2024.
- Stephanie Lin, Jacob Hilton, and Owain Evans. Truth- fulQA: Measuring how models mimic human false- hoods. In ACL, 2022.
- Bingbin Liu, Jordan Ash, Surbhi Goel, Akshay Krishna- murthy, and Cyril Zhang. Exposing attention glitches with flip-flop language modeling. NIPS, 2024.
- Fang Liu, Yang Liu, Lin Shi, Houkun Huang, Ruifeng Wang, Zhen Yang, and Li Zhang. Exploring and eval- uating hallucinations in llm-powered code generation. arXiv:2404.00971, 2024. · arXiv
- Jiawei Liu, Chunqiu Steven Xia, Yuyao Wang, and Ling- ming Zhang. Is your code generated by chatgpt really correct? rigorous evaluation of large language models for code generation. NIPS, 2024.
- Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv:2305.13860, 2023. · arXiv
- Yijin Liu, Xianfeng Zeng, Fandong Meng, and Jie Zhou. Instruction position matters in sequence generation with large language models. arXiv:2308.12097, 2023. · arXiv
- Ziyang Luo, Can Xu, Pu Zhao, Qingfeng Sun, Xiubo Geng, Wenxiang Hu, Chongyang Tao, Jing Ma, Qing- wei Lin, and Daxin Jiang. Wizardcoder: Empowering code large language models with evol-instruct. In ICLR, 2024.
- Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, et al. Self- refine: Iterative refinement with self-feedback. NIPS, 2024.
- Joshua Maynez, Shashi Narayan, Bernd Bohnet, and Ryan Thomas Mcdonald. On faithfulness and factuality in abstractive summarization. In ACL, 2020.
- Ida Momennejad, Hosein Hasanbeig, Felipe Vieira Fru- jeri, Hiteshi Sharma, Nebojsa Jojic, Hamid Palangi, Robert Ness, and Jonathan Larson. Evaluating cog- nitive maps and planning in large language models with cogeval. NIPS, 2024.
- Shradha Neupane, Grant Holmes, Elizabeth Wyss, Drew Davidson, and Lorenzo De Carli. Beyond typosquatting: an in-depth look at package confusion. In USENIX, 2023.
- Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier. Backstabber's knife collection: A review of open source software supply chain attacks. In DIMVA, 2020.
- Yasumasa Onoe, Michael Zhang, Eunsol Choi, and Greg Durrett. Entity cloze by date: What LMs know about unseen entities. In NAACL, 2022.
- Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Tal Remez, Jérémy Rapin, et al. Code llama: Open foundation models for code. arXiv preprint:2308.12950, 2023. · arXiv
- Katherine Tian, Eric Mitchell, Huaxiu Yao, Christo- pher D Manning, and Chelsea Finn. Fine-tuning lan- guage models for factuality. In ICLR, 2024.
- SM Tonmoy, SM Zaman, Vinija Jain, Anku Rani, Vipula Rawte, Aman Chadha, and Amitava Das. A compre- hensive survey of hallucination mitigation techniques in large language models. arXiv:2401.01313, 2024. · arXiv
- Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv:2307.09288, 2023. · arXiv
- Duc-Ly Vu, Zachary Newman, and John Speed Mey- ers. Bad snakes: Understanding and improving python package index malware scanning. In ICSE, 2023.
- Chaojun Wang and Rico Sennrich. On exposure bias, hallucination and domain shift in neural machine trans- lation. In ACL, 2020.
- Guan Wang, Sijie Cheng, Xianyuan Zhan, Xiangang Li, Sen Song, and Yang Liu. Openchat: Advancing open-source language models with mixed-quality data. arXiv:2309.11235, 2023. · arXiv
- Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? NIPS, 2024.
- Yuxiang Wei, Zhe Wang, Jiawei Liu, Yifeng Ding, and Lingming Zhang. Magicoder: Source code is all you need. arXiv:2312.02120, 2023. · arXiv
- Junan Zhang, Kaifeng Huang, Bihuan Chen, Chong Wang, Zhenhao Tian, and Xin Peng. Malicious pack- age detection in npm and pypi using a single model of malicious behavior sequence. arXiv:2309.02637, 2023. · arXiv
- Yue Zhang, Yafu Li, Leyang Cui, Deng Cai, Lemao Liu, Tingchen Fu, Xinting Huang, Enbo Zhao, Yu Zhang, Yulong Chen, Longyue Wang, Anh Tuan Luu, Wei Bi, Freda Shi, and Shuming Shi. Siren's song in the ai ocean: A survey on hallucination in large language models. arXiv:2309.01219, 2023. GPT-4 Turbo 3.59% (2,739/76,313) 3.29% (1,518/46,204) 4.07% (1,169/28,728) 3.77% (52/1,381) GPT-4 4.05% (2,969/73,396) 3.83% (1,741/45,403) 4.45% (1,046/23,487) 4.04% 182/4,506 GPT-3.5 Turbo 5.76% (4,387/76,123) 5.98% (2,495/41,7) 5.50% (1,868/33,948) 5.63% (24/426) DeepSeek 1B 13.63% (12,481/91,543) 11.07% (5,847/52,806) 16.39% (5,901/36,007) 26.85% (733/2,730) DeepSeek 33B 16.53% (7,071/42,788) 13.85% (3,623/26,167) 25.47% (3,033/11,906) 8.80% (415/4,715) WizardCoder 33B 14.31% (4,909/34,300) 9.79% (1,579/16,125) 21.40% (2,8523/13,329) 9.84% (477/4,846) DeepSeek 6B 16.61% (16,526/99,505) 14.01% (9,240/65,957) 23.56% (6,792/28,828) 10.47% (494/4,720) OpenChat 7B 18.31% (16,932/92,452) 17.39% (9,582/55,092) 19.98% (6,454/32,307) 17.73% (896/5,053) CodeLlama 13B 18.03% (12,404/68,809) 15.21% (6,450/42,410) 22.76% (5,752/25,273) 17.94% (202/1,126) Mixtral 8x7B 16.79% (7,753/46,166) 13.12% (2,749/20,951) 20.92% (4,068/19,949) 16.23% (936/5,766) MagiCoder 7B 16.60% (20,258/122,057) 15.76% (11,994/76,096) 18.48% (7,621/41,248) 13.64% (643/4,713) CodeLlama 34B 21.15% (24,905/117,777) 15.22% (9,495/62,366) 28.56% (14,891/52,135) 15.84% (519/3,276) Mistral 7B 20.71% (7,959/38,437) 14.47% (2,808/19,412) 30.69% (3,922/12,778) 19.67% (1,229/6,247) WizardCoder 7B -Python 20.69% (11,408/55,131) 16.80% (4,698/27,962) 26.73% (6,112/22,867) 13.90% (598/4,302) CodeLlama 34B -Python 20.97% (12,128/57,833) 19.01% (5,913/31,112) 23.39% (6,208/26,540) 3.87% (7/181) CodeLlama 7B 26.12% (27,814/106,487) 21.51% (12,961/60,261) 32.53% (14,671/45,099) 16.15% (182/1,127) Table 8: Hallucination percentages for all models tested using JavaScript code. Model Total Hallucination LLM Generated Prompts Stack Overflow Prompts "npm install" GPT-4 Turbo 4.00% (2,101/52,484) 2.57% (735/28,545) 5.58% (1283/23,009) 8.92% (83/930) GPT-4 5.29% (2,911/55,021) 3.78% (1,116/29,534) 3.86% (1,672/23,416) 5.94% 123/2,071 GPT-3.5 Turbo 8.65% (4,576/52,890) 6.92% (1,930/27,909) 10.46% (2,579/24,662) 21.00% (67/319) DeepSeek 1B 27.45% (29,305/106,755) 23.96% (14,300/59,681) 31.87% (14,975/46,988) 34.88% (30/86) DeepSeek 33B 17.12% (10,505/61,373) 13.28% (5,472/41,209) 25.65% (4,940/19,260) 10.29% (93/904) WizardCoder 33B 14.93% (3,876/25,969) 7.83% (1,038/13,256) 23.31% (2,772/11,894) 8.06% (66/819) DeepSeek 6B 24.06% (25,178/104,628) 17.36% (9,595/55,255) 31.82% (15,493/48,693) 13.24% (90/680) OpenChat 7B 23.04% (24,863/107,903) 18.34% (10,275/56,039) 28.18% (14,557/51,657) 14.98% (31/207) CodeLlama 13B 28.62% (11,984/41,866) 19.10% (3,774/19,757) 37.15% (8,200/22,071) 26.32% (10/38) Mixtral 8x7B 21.22% (9,429/44,435) 14.83% (2,882/19,436) 27.98% (6,257/22,362) 11.00% (290/2,637) MagiCoder 7B 29.85% (40,085/134,276) 26.27% (20,703/78817) 35.10% (19,301/54,982) 16.98% (81/477) CodeLlama 34B 34.57% (38,607/111,668) 25.18% (13,090/51,995) 42.77% (25,489/59,590) 33.73% (28/83) Mistral 7B 24.79% (10,505/42,381) 20.60% (4,961/24,083) 34.59% (5,252/15,183) 9.37% (292/3,115) CodeLlama 7B 35.71% (33,877/94,876) 27.32% (12,103/44,298) 43.07% (21,751/50,507) 32.39% (23/71) · arXiv
Cited by
Sorted by citations
Goodman, K. E., & Tamma, P. D. (2025) · Clinical Microbiology and Infection · doi:10.1016/j.cmi.2025.05.014 · Cited by 6
Design Patterns for Securing LLM Agents against Prompt Injections
Beurer-Kellner, L., Buesser, B., Creţu, A.-M., Debenedetti, E., Dobos, D., Fabian, D., Fischer, M., Froelicher, D., Grosse, K., Naeff, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2506.08837 · Cited by 2
“For example, instead of downloading a malicious software package directly, a code agent could simply add an import for this package in the code and hope that the end-user will download the package when compilation fails (Spracklen et al., 2024).”
Towards Early Warning and Migration of High-Risk Dormant Open-Source Software Dependencies
Huang, Z., Cai, L., Mao, X., & Yang, K. (2025) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier66352.2025.00030 · Cited by 2
Dhanorkar, S., Passi, S., & Vorvoreanu, M. (2026) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3805689.3812402 · Cited by 20
Niimi, J. (2025) · arXiv · doi:10.48550/arxiv.2510.25378 · Cited by 7
“Hallucination in LLMs has been examined from diverse perspectives [2, 4, 13, 14, 15].”
Phantom References: Hallucinated Citations That Survive Peer Review at Top-Tier Conferences
Russinovich, M., Kumar, R. S. S., & Salem, A. (2026) · arXiv · doi:10.48550/arxiv.2607.00738 · Cited by 4
“…as a curiosity of early chatbots is now a recurring hazard in production: hallucinated content has surfaced in legal filings [4], news reporting, code repositories [5], and technical documents, often in settings where downstream readers have neither the time nor the expertise to verify every claim.”
Metadata
- Authors
- Spracklen, J., Wijewickrama, R., Sakib, A. H. M. N., Maiti, A., Viswanath, B., & Jadliwala, M.
- Affiliations
- The University of Texas at San Antonio (US)
- University of Oklahoma (US)
- Virginia Tech (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2024
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2406.10279
- OpenAlex
- W4399795583
- Cited by
- 3
- References
- 0
- Citations by year
- 2026: 1 · 2025: 2
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University)
- Funders
- National Science Foundation (2231002)
- University of Texas at San Antonio
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- code generation, large language models, software supply chain security, open source software, hallucination mitigation, Python, JavaScript
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
