The package that did not exist
Your AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.
This answers: Can an AI suggest a malicious npm package? No coding needed. 2 quick decisions.
- Supervising your AI
- Keys and secrets
Checking your access…
Can an AI suggest a malicious npm package?
Yes. AI models sometimes invent plausible package names, and attackers register those names with malicious code, an attack called slopsquatting. Installing a package can run its scripts immediately. Before installing an unfamiliar package, check it is real, widely used, linked to a real repository and has no unexpected install scripts.
Breaks at Package registry: Invented name, real malware
Why AI tools write this bug
Models predict likely-sounding names, so they confidently suggest packages that would make sense but have never existed.
How to fix it
- Check unfamiliar packages on the registry before installing.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- What is slopsquatting?
- Registering package names that AI tools tend to invent, so people who install the AI's suggestion get the attacker's code.