Article · 2026-09-02

The lockfile filed a name the registry never had

Your coding agent did not choose a risky dependency. It invented one.

Your coding agent did not choose a risky dependency.

It invented one. Then it wrote the name into the manifest like it had looked it up.

The chat said install X. You, or the agent, ran the installer. Nobody queried the live registry. If X does not exist, you get a 404 and feel lucky. If someone registered that hallucination last week, the install succeeds. That is slopsquatting: the model invents a plausible package, an attacker claims the name, your lockfile now pins whatever they published.

A 2025 study found LLMs recommend nonexistent packages in roughly one in five code samples. Attackers register those names. You do not need the paper. You have watched an agent type a library you have never heard of and talk as if it were a package everyone already uses.

Look the name up first

Before the agent adds, upgrades, or recommends a dependency, check the real registry for this language. The live page, not a summary the model wrote.

If the exact name is not there, do not add it. Do not try the install and see. Do not let the agent park the name in the manifest so the lockfile can resolve it later. A missing name is a stop, not a prompt to invent a substitute.

The other ways this lands anyway

Typosquat. One character off a popular package. The agent corrected a spelling. Both names exist. Yours is the wrong one.

Abandoned maintainer. The package exists. Last publish was 2019. Issues sit unanswered. You inherited a dead dependency because the chat remembered the name.

API that is not on the version that installed. The agent calls a helper from docs it invented. The lockfile pinned 2.4.1. That helper shipped in 3.1. Tests are green until production.

While I am here. The ticket needed one library. The agent added three helpers. Each extra name skipped the same check.

The lockfile is a record, not a lookup

A lockfile hashes what got installed. It does not prove the name was real, maintained, or the package the agent thought it was. If the agent typed the string, the lockfile will pin whatever the registry returned for that string.

Use the lockfile as source of truth for versions after the name has been verified. Not before.

Do this on the next ticket

One install. Registry lookup first: does this exact name exist on the registry for this language. Then a maintenance glance: last publish, a real repo, downloads that are not a rounding error. Then a one-character check against the popular package you actually meant. Then install. Then confirm the API the agent wants to call exists in the version that landed.

If the name is not on the registry, stop. Do not add a cousin the agent invented in the same breath. Look up the real package yourself.

The drop-in rules file that makes the agent ask the registry first is Dependency Guardrails, $29.