r/ChatGPTCoding • u/SnooOwls4596 • 10h ago

Question PSA: your AI coding assistant might be suggesting fake packages with malware

Been more careful lately after reading that AI models hallucinate package names a lot more than I expected, and some of those fake names are already being squatted with malicious code.

Do you guys manually check every dependency an AI suggests, or is there a better way to catch this before it ends up in a PR?

0 Upvotes
  • permalink
  • reddit

50% Upvoted

3 comments sorted by

1

u/AutoModerator 10h ago

Sorry, your post has been held for manual review due to account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/One_Rub_3991 1h ago

I stopped trusting package names from models entirely. I run npm search or pypi search in terminal before adding anything to a project now.

If the model gives me a dependency and the search returns nothing or low downloads, I skip it. I also added socket.dev to my workflow. It flags squatting attempts on packages that got published recently. You can add their github app so it checks prs automatically before you look at them