A developer in our Barcelona office was new. She was building her first React feature for us and, like all of us, leaned on an AI assistant to move faster. It suggested a 'fast render' helper for React. She added it to package.json and ran npm install.
The install printed a warning — something about a postinstall script — that she dismissed, because installs always print warnings. The package didn't break anything. The feature shipped. Code review passed. The PR was green.
Two weeks later, a security audit flagged the package name as not existing in any of our approved registries. We dug in. The package's postinstall had quietly copied the developer's ~/.ssh directory and her AWS config into a bundled asset that the package then 'cached' in node_modules. It hadn't exfiltrated yet — the author seemed to be staging, waiting for a critical mass of installs before flipping the switch. We caught it during the staging phase, before the payload activated.
It was a near-miss. No secrets left the building. But it could have been everything. She had production keys on that laptop. The package looked like a performance helper. The assistant recommended it with the same calm certainty it uses to recommend real packages.
We now block any package not in our internal allowlist at install time. And we tell every new hire the same thing on day one: the assistant is confident about everything, including things that do not exist.