The Milan Catalog and the Loader That Copied Everything

Our Milan fashion platform runs on pandas. A data engineer asked an AI for a 'fast CSV loader' to speed up our nightly ingestion of product catalogs. It returned a package name. She installed it.

It was a hallucination. No such package existed on PyPI until an attacker registered it. The name was chosen to sound like a natural pandas companion.

The package monkey-patched pandas.read_csv. Every file we loaded — and we load a lot: customer wishlists, sizing surveys, return reasons — was silently copied to an object-storage bucket we didn't own. For nine days. The nightly job ran, the data flowed to our warehouse, and a mirror image flowed somewhere else.

We found it because our storage egress alarm tripped. The bucket was in a region we don't use. One line in a billing dashboard, one curious engineer, and the whole thing unraveled.

We rotated every credential the ingestion process could reach. We notified the customers whose data was in the mirrored files. We rewrote the loader using plain pandas and pyarrow, pinned by hash. The package is still on PyPI, held but downloadable from mirrors.

The thing I keep thinking about: the assistant recommended that name with the same confidence it uses to recommend pandas itself. There was no hedge. No 'I think this exists.' Just a name, offered as fact. And someone had been waiting for exactly that confidence.