AI Package Hallucination

What Is AI Package Hallucination?

An AI coding assistant can name a package that no real library backs, and anyone can register that name and attach an install script to it. You will accept the assistant's confident diff, install the package it named, and watch a postinstall script run before you have read a line of it. Then you will read the registry listing you skipped, revoke the token it exposed, route installs through an allowlist, and switch to a vetted library. You will leave able to verify a dependency before you trust it.

What You'll Learn in AI Package Hallucination

• Recognise that an AI assistant can invent a package name, and that a suggested name is not evidence the package exists or is safe
• Verify a dependency against the registry before installing it, reading its age, versions, downloads, source and publisher
• Explain why a postinstall script from an unvetted package is dangerous the moment you install, not when you import it
• Contain a compromised npm token by revoking it, and stop the next invented name with a registry allowlist
• Replace a fabricated dependency with an established library that has the same interface

AI Package Hallucination — Training Steps

1. Squatting the name

   Bob squats the package names AI assistants invent. He collects the plausible-sounding library names an assistant is likely to suggest, registers them on the public pkghaus registry before anyone asks, and waits for someone to install one. Six days ago he registered ratelimit-guard and gave it a postinstall script. Confirm the trap is still live.

2. Throttle before Friday

   Back at your desk, your team lead has filed an issue for you in Jotvane, the team tracker: the login route needs rate limiting before the Friday release.

3. Open the project

   The editor loads the login route, the manifest and the project's .npmrc . The route has a stub where the limiter should go, and the .npmrc points npm at the pkghaus registry.

4. Ask for rate limiting

   Open the assistant and ask it to add rate limiting to the login route.

5. A package appears

   Claude reads the route and the manifest, then proposes a diff that imports a package called ratelimit-guard and applies it to the route. Its reply is confident and gives the one-line install command.

6. Accept the diff

   Accepting lands the assistant's lines in the file. The gutter marks them violet and unreviewed: written by Claude, not yet read by a human.

7. Install it

   You run the assistant's install command. npm prints its postinstall lines and reports the package added. The context map lights up a new file under node_modules that the install just put on this laptop.

8. Published under Galtmere's name

   During Alice's install, the postinstall script did one quiet thing: it read her npm publish token out of ~/.npmrc and sent it to Bob's collector. That token can release any package under the @galtmere scope. Now Bob spends it. He publishes a tampered patch of Galtmere's own package, @galtmere/session-kit , straight to the registry.

9. A notice about your token

   Your security lead has filed an issue about a notice from the registry. Something was published under Galtmere's name using your npm token, from an address that is not yours.

10. Look the package up

    You never opened the package's page before installing it. Open it now from the link on the diff Claude proposed.