{"object":"corpus_info","corpus_version":"2026.07.14-seed1","corpus_updated":"2026-07-14","corpus_provenance":[{"source":"Bar Lanyado / Lasso Security — 'AI package hallucination'","url":"https://www.lasso.security/blog/ai-package-hallucinations","note":"huggingface-cli PoC (LLMs repeatedly suggested a non-existent pip package; an empty placeholder drew 30k+ installs)."},{"source":"Spracklen et al. 2024 — 'We Have a Package for You' (package hallucination in code-gen LLMs)","url":"https://arxiv.org/abs/2406.10279","note":"19.7% of recommended packages hallucinated across 16 models / 576k samples; a subset of names is repeated identically across models."},{"source":"Aikido / Trend Micro / CSA slopsquatting research-notes 2025-2026","url":"https://www.aikido.dev/blog/slopsquatting-ai-package-hallucination-attacks","note":"Named attack class; 127 names hallucinated by 5+ models (109 PyPI / 18 npm)."}],"ecosystems":{"npm":{"osv_ecosystem":"npm","top_n_count":243,"top_n_snapshot":"2026-07-14","top_n_source":"curated most-downloaded / most-depended-upon npm packages","hallucination_corpus_count":0},"pypi":{"osv_ecosystem":"PyPI","top_n_count":5000,"top_n_snapshot":"2026-07-01","top_n_source":"hugovk/top-pypi-packages (top-pypi-packages.min.json)","hallucination_corpus_count":1}},"dimensions":["exists","is_malicious","is_typosquat","is_hallucinated","suspicious_metadata"],"signals":{"osv_live":true,"osv_malware_prefix":"MAL-","typosquat_max_edit_distance":2,"age_young_days":30,"low_downloads_week":100,"batch_max":100},"sources":{"registry":{"npm":"registry.npmjs.org","pypi":"pypi.org"},"malware":"api.osv.dev (OSV.dev / OpenSSF malicious-packages, Apache-2.0)","metadata":"api.deps.dev + official registries"},"disclaimer":"Automated supply-chain / install-safety indicators, not a guarantee. A 'safe' verdict is not an endorsement; verify before installing.","note":"Freshness = a DATA update of the bundled top-N lists + hallucination corpus (no live daemon); OSV malware is queried live per request."}