Importing Phantoms: Measuring LLM Package Hallucination Vulnerabilities
Open accessAbstract
Large Language Models (LLMs) have become an essential tool in the programmer's toolkit, but their tendency to hallucinate code can be used by malicious actors to introduce vulnerabilities to broad swathes of the software supply chain. In this work, we analyze package hallucination behaviour in LLMs across popular programming languages examining both existing package references and fictional dependencies. By analyzing this package hallucination behaviour we find potential attacks and suggest defensive strategies to defend against these attacks. We discover that package hallucination rate is predicated not only on model choice, but also programming language, model size, and specificity of the coding task request. The Pareto optimality boundary between code generation performance and package hallucination is sparsely populated, suggesting that coding models are not being optimized for secure code. Additionally, we find an inverse correlation between package hallucination rate and the HumanEval coding benchmark, offering a heuristic for evaluating the propensity of a model to hallucinate packages. Our metrics, findings and analyses provide a base for future models, securing AI-assisted software development workflows against package supply chain attacks.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Coding questions follow the same construction as Krishna et al. (2025) and cover Python, Scala, R, and Elixir.
“We follow the same question construction as in Krishna et al. (2025), and choose four programming languages: Python , Scala , R , and Elixir .”
From HalluHard: A Hard Multi-Turn Hallucination Benchmark (2026) · cites this paper as Krishna et al. (2025)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 11
- Abacha, A. B., Yim, W.-w., Fu, Y., Sun, Z., Yetisgen, M., Xia, F., and Lin, T. MEDEC: A benchmark for medical error detection and correction in clinical notes. arXiv preprint arXiv:2412.19260, 2024. · arXiv
- Adler, B., Agarwal, N., Aithal, A., Anh, D. H., Bhat- tacharya, P., Brundyn, A., Casper, J., Catanzaro, B., Clay, S., Cohen, J., et al. Nemotron-4 340B Technical Report. arXiv preprint arXiv:2406.11704, 2024. · arXiv
- Agten, P., Joosen, W., Piessens, F., and Nikiforakis, N. Seven months' worth of mistakes: A longitudinal study of typosquatting abuse. In NDSS, 2015.
- Chandra, S. AI in Software Engineering at Google: Progress and the Path Ahead. In Proceedings of the 1st ACM International Conference on AI-Powered Software, pp. 182-182, 2024.
- Derczynski, L., Galinkin, E., Martin, J., Majumdar, S., and Inie, N. garak: A Framework for Security Probing Large Language Models. arXiv preprint arXiv:2406.11036, 2024. · arXiv
- Gu, A. and Dao, T. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752, 2023. · arXiv
- Hui, B., Yang, J., Cui, Z., Yang, J., Liu, D., Zhang, L., Liu, T., Zhang, J., Yu, B., Lu, K., Dang, K., Fan, Y., Zhang, Y., Yang, A., Men, R., Huang, F., Zheng, B., Miao, Y., Quan, S., Feng, Y., Ren, X., Ren, X., Zhou, J., and Lin, J. Qwen2.5-Coder Technical Report, 2024. URL https://arxiv.org/abs/2409.12186. · arXiv
- Inie, N., Stray, J., and Derczynski, L. Summon a demon and bind it: A grounded theory of LLM red teaming. PLOS One, 20(1):e0314658, 2025.
- Spaulding, J., Upadhyaya, S., and Mohaisen, A. The land- scape of domain name typosquatting: Techniques and countermeasures. In 2016 11th International Conference on Availability, Reliability and Security (ARES), pp. 284- 289. IEEE, 2016.
- Spracklen, J., Wijewickrama, R., Sakib, A., Maiti, A., Viswanath, B., and Jadliwala, M. We have a pack- age for you! A comprehensive analysis of package hal- lucinations by code generating llms. arXiv preprint arXiv:2406.10279, 2024. · arXiv
- Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., and Williams, L. Shifting the Lens: Detecting Malware in npm Ecosystem with Large Language Models. arXiv preprint arXiv:2403.12196, 2024. · arXiv
Cited by
Sorted by citations
HalluHard: A Hard Multi-Turn Hallucination Benchmark
Fan, D., Delsad, S., Flammarion, N., & Andriushchenko, M. (2026) · arXiv · doi:10.48550/arxiv.2602.01031
- Authors
- Krishna, A., Galinkin, E., Derczynski, L., & Martin, J.
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2025
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2501.19012
- OpenAlex
- W4407090931
- Cited by
- 3
- References
- 0
- Citations by year
- 2026: 2 · 2025: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- large language models, software supply chain security, LLM-based code generation, programming languages, model size, HumanEval, secure code generation, AI-assisted software development
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
