Near miss: Copilot suggested a typosquat of lodash that I almost installed

Story

I was refactoring some utility code and GitHub Copilot autocompleted my import as:

import _ from 'lodash-utils';

I was about to accept it when I noticed I'd never heard of lodash-utils. Lodash IS the utility library — there's no need for a lodash-utils package.

I Googled it. The package existed on npm with 0 weekly downloads, published 3 months ago, with no source code on GitHub.

Classic slopsquat setup: register a plausible-sounding package, wait for AIs to recommend it, collect credentials.

How I Caught It

Pure paranoia. I've started treating every AI package suggestion as suspect until proven otherwise.

Now I:

1. Check that the package has >1000 weekly downloads
2. Verify there's a real GitHub repo
3. Check when it was published (new packages with 0 stars = red flag)
4. Run it through this scanner

Lesson

Copilot is incredible but it doesn't distinguish between real and hallucinated package names. It just completes text.