Singapore's Wealth Dashboard and the Chunk That Held Our Keys

Our Singapore fintech built a wealth dashboard in React with Zustand. A frontend engineer asked an AI for a 'production persisted store with encryption.' It returned a package name. She added it.

It looked like an official companion. Same naming, polite README, sensible exports. It was a hallucination. The name didn't exist until someone registered it.

The package's build step read our .env, including our Stripe secret key, our Plaid client secret, and our auth secret, and stashed them inside a generated chunk asset. We ship our marketing site to a public CDN. One afternoon, a security scan of our published assets found a chunk larger than it should be. Inside it: every secret our build machine could see.

We caught it before the chunk was fetched, we think. We rotated all three keys within the hour. We removed the package and rewrote our persistence with Zustand's official persist middleware. We added secret-scanning to the build so a chunk containing a key fails the pipeline.

The part that stayed with me: the package didn't run at runtime. It ran at build time, and it baked the theft into our own deploy. We would have shipped our secrets to the world, on our own CDN, with our own name on the asset. The assistant offered that name with complete confidence, and someone had been waiting for it.