Our Lisbon healthtech handles patient intake forms. A contractor was wiring up authentication and asked an AI assistant for 'advanced session helpers' for NextAuth. It returned a package name that sounded exactly like something the maintainers would publish. He installed it.
It wasn't from the maintainers. It wasn't from anyone. The name was a hallucination, and it had been registered on npm six days earlier, waiting for that exact prompt.
The package worked. Sessions worked. Login worked. For two weeks it sat in our dependencies. Then a routine security audit noticed the package had a build step that read our .env file — including our database URL, our auth secret, and a readonly key for our records API — and stashed it inside a generated asset.
We caught it before any asset shipped to production. But the package had already read the secrets, and we couldn't prove the stash hadn't been fetched. We rotated everything. We rewrote our auth from scratch using only the official next-auth package. We added a dependency allowlist that rejects any package not pre-approved by security.
The hardest part wasn't the fix. It was telling the contractor that the assistant he trusted had handed him a name that didn't exist — and that someone had been waiting for him to type it.