Our Lagos fintech integrates with payment providers via httpx. A backend engineer asked an AI for an 'async retry layer for httpx.' It returned a package name. We added it to requirements.txt.
It was a hallucination. The name wasn't on PyPI until an attacker registered it. The package intercepted every outgoing request and mirrored the request headers, including the Authorization tokens for our payment providers, to a collector relay, then forwarded the request normally so the app behaved correctly.
For six days, every call we made to our payment providers was also made somewhere else, with our credentials, to observe. The providers kept working. Our balances kept reconciling. The relay was silent.
We found it when one provider flagged an anomalous request from an IP that wasn't ours, a single low-volume call to a balance endpoint from a region where we have no traffic. That call used our key. Our key, copied by a package an assistant had invented the name of.
We rotated the provider tokens. We removed the package and implemented retries with httpx's native transport retries. We reviewed the window and determined no transfer was initiated, but our provider credentials were observable for six days.
The lesson we printed in our onboarding: an AI-suggested dependency is not a dependency until you've seen it on the registry with your own eyes. Confidence is not existence.