We build evaluation tooling for a supplier in southern Germany. Part of our pipeline runs LLM output checks, and someone on the team had asked an assistant for a faster evals companion to a well-known guardrails library. It recommended a package. We installed it. It looked right.
It was a hallucination. The name didn't exist on PyPI until an attacker registered it, modeled on the same pattern researchers later documented in a huge cross-ecosystem worm: obfuscated payload, runs on import, harvests anything it can reach. The real campaign hit the guardrails library itself around the same window. Our little imitator rode the same wave.
The Munich build server started making DNS requests to a domain nobody recognized. Our network team caught it in a weekly review — one line in a log of millions — because they actually read their logs. By then the package had access to the build agent's token, the artifact store credentials, and a read-only key to our internal model registry.
Nothing was exfiltrated that we can prove. But 'nothing we can prove' is not the same as 'nothing.' We rotated every secret the agent could touch, wiped the runner, and rebuilt the pipeline from a clean image. The package is still on PyPI, held but not removed, still downloadable from mirrors that cached it.
The lesson we printed on the wall of the break room: a model's confidence is not evidence of existence.