Hallucinated packages are a supply-chain problem now

Here's a failure mode that didn't exist a few years ago: your AI assistant writes import { retryWithBackoff } from "async-retry-utils" — a package that does not exist. You run npm install. It fails, you shrug, you move on.

But sometimes it doesn't fail. Because someone registered that name first.

Slopsquatting

Attackers have figured out that LLMs hallucinate the same plausible-sounding package names over and over. So they pre-register those names with malicious payloads and wait. The AI recommends the package, you install it, and now you're running attacker code. It's typosquatting, but the AI is the one making the typo.

This is a supply-chain attack with a brand-new entry point, and npm install succeeding is the worst outcome, not the best one.

The fix is boring and it works

Check every import against what's actually declared before it can hurt you. That's the whole idea behind ImportGuard.

// pseudocode
for (const imp of importsInFile) {
  const pkg = resolvePackageName(imp); // handles scopes + subpaths
  if (!declaredIn(nearestPackageJson, pkg)) {
    flag(imp, "not declared in package.json");
  }
}

• Works across JS/TS/Angular/JSX/TSX and Python.
• Understands scoped packages (@scope/pkg), subpaths (pkg/some/module), and monorepos — it walks up the tree to the nearest package.json.
• Runs automatically on file open/save, so you see the problem the instant the AI writes it — not after a failed install, and definitely not in production.

Why local, why now

You could catch some of this in CI. But CI is minutes-to-hours later, after you've context-switched. The whole point of these tools is to catch the problem at the exact moment it's introduced, on your machine, with zero network round-trips.

AI coding is a force multiplier. It multiplies the good and the bad. The response isn't to stop using it — it's to build small, sharp guardrails around the specific new ways it fails.

That's the thread across everything I ship: leaked secrets, hardcoded secrets, and now hallucinated imports. Same philosophy, three tools.