I asked the AI for a date library. It gave me a backdoor.

The Ask

Needed timezone-aware date formatting. ChatGPT suggested date-fns-tz-utils alongside date-fns. Sounded like an official addon.

The Backdoor

It exported a working formatTZ function. It also, on load, registered a service worker that intercepted fetch calls to our auth endpoint and copied tokens.

The Symptom

We noticed when a staging token appeared in an unfamiliar request log. Traced it to the browser. Traced the service worker to the package.

Lesson

-utils suffix packages are a classic slopsquat pattern. Real addons usually live inside the main package, not as a sibling with a similar name.