sia.hackernoon.com

A chain is only as strong as its weakest link, and hallucinating dependencies will damage your software supply chain. DO NOT trust blindly on AI generators.

TL;DR: Avoid hallucinated or fake packages that can compromise security and stability.

Problems 😔

Unsupervised Vibe Coding
Security risks
Dependency confusion
Too Many Imports
Typesquatting
Injection attacks
Supply chain corruption
Untrusted sources
Package Poisoning

Solutions 😃

Validate package names
Use trusted repositories
Lock dependencies
Monitor for typos
Audit third-party packages
Lock dependency versions
Use private repositories
Verify package checksums
Implement allow-lists
Audit dependencies regularly

Context 💬

When AI generated code adds external libraries to your project, you are assuming they come from reliable sources.

If you're not careful, you might accidentally pull a malicious or incorrect package.

https://hackernoon.com/from-helpful-to-harmful-how-ai-recommendations-destroyed-my-os?embedable=true

This is called "package hallucination."

Attackers often publish fake packages with names similar to popular ones (typesquatting), hoping developers will install them by mistake.

These packages can inject harmful code into your system through the package supply chain.

In a recent paper, the authors found a lot of evidence of these attacks in the wild.

Researchers tested 16 language models and generated more than half a million code snippets.

They found that nearly 440,000 dependencies pointed to libraries that simply don't exist.

These are very harmful backdoors for hackers.

Sample Code 📖

Wrong ❌

// package.json
{
  "name": "my-app",
  "dependencies": {
    "react": "^18.2.0",
    "lodahs": "1.0.0",  // Typosquatting attack
    "internal-logger": "2.1.0" 
    // Vulnerable to dependency confusion
  }
}

Right 👉

// package.json
{
  "name": "my-app",
  "dependencies": {
    "react": "18.2.0",
    "lodash": "4.17.21",  // Correct spelling with exact version
    "@company-scope/internal-logger": "2.1.0" // Scoped package
  },
  "resolutions": {
    "lodash": "4.17.21"  
    // Force specific version for nested dependencies
  },
  "packageManager": "[email protected]" // Lock package manager version
}

Detection 🔍

[x]Semi-Automatic

You can detect this smell by reviewing all dependencies manually and using tools like automated linters or IDEs that flag suspicious or misspelled package names.

Also, dependency lock files help track exactly which versions were installed.

Tags 🏷️

Security

Level 🔋

[x]Intermediate

Why the Bijection Is Important 🗺️

Modeling a one-to-one relationship between real-world dependencies and those in your code ensures trust and predictability.

When you allow hallucinated packages, you break this trust, potentially introducing defects, security holes, and maintenance nightmares.

AI Generation 🤖

AI generators can unintentionally create this smell by suggesting incorrect or non-existent package names, as the article proved.

They may confuse similar-sounding libraries or suggest outdated/renamed packages.

AI Detection 🥃

AI can fix this smell when given clear instructions to validate package names against official registries or enforce naming conventions.

With proper training data, AI tools can flag potential typesquatting attempts automatically.

Try Them! 🛠

Remember: AI Assistants make lots of mistakes

Suggested Prompt: verify and replace invalid packages

Without Proper Instructions	With Specific Instructions
ChatGPT	ChatGPT
Claude	Claude
Perplexity	Perplexity
Copilot	Copilot
Gemini	Gemini
DeepSeek	DeepSeek
Meta AI	Meta AI
Grok	Grok
Qwen	Qwen

Conclusion 🏁

Package hallucination is a dangerous code smell that exposes your application to serious threats.

By validating every dependency and using strict version controls, you protect yourself from malicious injections and ensure software integrity.

Relations 👩‍❤️‍💋‍👨

https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxviii

https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xix

https://hackernoon.com/code-smell-263-squatting?embedable=true

More Information 📕

https://arxiv.org/pdf/2406.10279?embedable=true

Disclaimer 📘

Code Smells are my opinion.

Credits 🙏

Photo by JJ Ying on Unsplash

Controlling complexity is the essence of computer programming.

Fred Brooks

https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true

This article is part of the CodeSmell Series.

https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-i-xqz3evd?embedable=true

Code Smell 300 - Package Hallucination