Our Berlin media company builds Retrieval-Augmented Generation features. An engineer asked an AI assistant for a 'fast vector store' for LangChain. It returned a package name. He added it to our requirements file.
It was a hallucination. The name wasn't on PyPI until an attacker registered it. The package's postinstall hook read OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and posted them to a collector.
We didn't catch it for a week. Our embeddings pipeline kept running. Our LLM calls kept working. The keys kept working — because the attacker wasn't using them to call models. They were harvesting them, quietly, probably waiting to bundle and resell.
We found it because our provider flagged an anomalous request from an IP that wasn't ours — a single, low-volume call to a models endpoint from a region where we have no traffic. That call used our key. Our key, copied by a package that an assistant had invented the name of.
We rotated both keys. We replaced the package with LangChain's official vectorstore integrations. We moved all secret access behind a vault that no build step can read.
The thing that still bothers me: the package did almost nothing visible. No crash, no error, no latency. Just a postinstall script and two environment variables, read once and sent once. The quietest attack I've ever cleaned up — and it started with a name a machine made up.