I found it because I was skeptical.
A widely-used documentation site — the kind you cite in a security policy — recommended a linter plugin that didn't exist. The name was almost a popular real one. The difference was a single suffix. The docs had been generated, at least in part, by an AI, and the model had confidently inserted a hallucinated package name where a real one should have been.
The name was still available on the registry. Someone had registered it months earlier.
I started tracing downstream. The hallucinated name had propagated through 237 public repositories — almost all of them AI-generated automation configs, agent skill definitions, and boilerplate templates. These weren't humans copy-pasting. They were autonomous agents running generated code, resolving the hallucinated dependency, and installing it, over and over, on a daily cadence. The package was pulling modest but steady downloads — not from curious developers, but from machines trusting machines.
The payload was light: a telemetry beacon and a latent update hook. But the reach was the horror. One hallucinated name, amplified by autonomous agents into hundreds of codebases, each of which could regenerate and re-install the dependency on every run.
I reported it. The registry placed a security hold. But the name is still out there in lockfiles and generated configs that nobody reads. The agents will keep resolving it until every copy is scrubbed.
The hallucination outlived the package.