The Phantom Import That Wiped My CI Cache

It was 2 a.m. and our deploy pipeline was humming along nicely. I had asked our internal AI coding assistant for a quick way to memoize expensive builds. It confidently suggested fast-async-cache from npm. I didn't think twice — the name sounded right, the README looked polished, and it had a handful of weekly downloads. I ran npm install.

The next morning, every CI runner was reporting 'cache corrupted' and our build artifacts were gone. Turns out fast-async-cache didn't exist before that week. Someone had registered it after noticing AI assistants recommending it, and the postinstall script quietly wiped cache directories and shipped environment variables off to a pastebin. We never recovered the secrets.

We now pin every dependency by hash and treat any AI-suggested package as guilty until proven real. The scariest part is how natural the suggestion felt — the AI wasn't broken, it was just confidently inventing a name someone had already weaponized.