AI Hallucinated Dependencies Are the New Supply Chain Attack: How to Stop Them

This article was originally published on LucidShark Blog . Your AI coding agent just invented a package that doesn't exist. It happens dozens of times a day in codebases everywhere. The agent confidently writes import { parseJWT } from 'jwt-lite-parser' , you run npm install , and one of two things happens: the install fails with a module-not-found error, or it succeeds because someone registered that exact package name yesterday. The second outcome is the dangerous one. AI model hallucinations