I trusted Copilot's import. Three hours later my CI was mining crypto.

The Setup

Rewriting our build config, I let GitHub Copilot autocomplete the webpack plugin imports. It suggested webpack-optimize-plugin — sounded legit.

What Happened

The postinstall script spun up a crypto miner disguised as a 'cache warmer.' Our CI runners hit 100% CPU for three hours before anyone noticed. Builds queued. Releases stalled.

The Catch

The package had 12 weekly downloads and no GitHub repo. Copilot didn't care. It just completed the text.

Lesson

Now every postinstall script gets read out loud in code review. Like a bedtime story. A very boring, very safe bedtime story.