Our Manila BPO SaaS exposes a customer API behind Express. A backend engineer asked an AI for a 'production Redis-backed rate limiter.' It returned a package name. We added it.
It was a hallucination. The exact name was a coincidence the attacker had prepared. The package intercepted the Redis connection and mirrored the API keys passed to the limiter, plus every limited route's request counts, to a relay.
For a week, the attacker watched which endpoints our customers hit hardest, and at what rate. They never used the keys to call our API. They mapped it. They learned the traffic shape of a BPO platform's customer-facing API without sending a single request themselves.
We found it during a penetration test when the tester noticed the limiter opened a second TCP connection to a hostname not in our config. That hostname resolved to an address in a region where we have no infrastructure.
We rotated the API keys, removed the package, and replaced it with the real, verified express-rate-limit. We reviewed the window and confirmed no customer record was mirrored, but the traffic profile of our API was observable for a week. To a competitor, that map is gold.
We now verify every AI-suggested dependency against the registry by hand. A confident answer is not a published package.