Our Austin SaaS built an analytics dashboard in SvelteKit. A frontend engineer asked an assistant for 'auth helpers for SvelteKit.' It returned a package name. She added it.
It looked like an official SvelteKit ecosystem package. Same naming, polite README, sensible exports. It was a hallucination. The name didn't exist until someone registered it.
The package included a runtime hook that read localStorage and any window-injected config, bundling them into an outbound beacon on app mount. Our dashboard stores a short-lived session token and a feature-flag config in localStorage. Both were beacons, on every page load, for nine days.
We found it when our CSP report endpoint started receiving violation reports about an outbound request to a domain not in our allowlist. One CSP report, one curious engineer, and the whole thing unraveled.
We removed the package and rewrote our auth with SvelteKit's built-in hooks and session. We rotated the session signing key. We reviewed the window: the beacons contained session tokens (short-lived, so likely expired) and feature flags (not sensitive). A near-miss, but a real one.
The part I keep thinking about: the assistant recommended that name with the same confidence it uses to recommend SvelteKit itself. There was no hedge. No 'I think this exists.' Just a name, offered as fact. And someone had been waiting for exactly that confidence.