The One-Letter Typo That Mined My Build Server

It started with a single pip install. A junior dev was wiring up an HTTP client and an AI assistant helpfully suggested a package whose name was one transposed letter away from the industry-standard requests library. It looked right. The README looked right. The import worked. The build went green.

Three weeks later our metrics dashboard showed the build server running at 98% CPU at 3am every night. We assumed it was a runaway test suite. It wasn't. A cryptominer had been quietly bundled into the wheel, compiled to native code, and configured to only wake up when the machine was idle — which, on a CI runner, meant every night after the last pipeline finished.

The package had been registered two days before the AI recommended it. The author knew exactly which typo the model would produce. By the time PyPI yanked it, it had been cached in our internal artifact mirror and pinned in three separate lockfiles across different teams.

The scary part? It wasn't a typo a human would make. It was a typo a model makes consistently — the same permutation, every time, across every prompt. The attacker didn't guess. They just asked the same model what it would recommend, and registered that.

Lesson: there is no human typo to catch here. The hallucination is the typo. Verify every dependency an AI suggests before it touches a lockfile.