📊 Help us build the Phantom Package Database — share your hallucinated imports!

[raye-deng]

Calling all AI coding assistant users! 📣

We're building a public database of AI-hallucinated npm/PyPI package names — packages that AI coding assistants reference but don't actually exist on the registry.

Why This Matters

These phantom names are prime targets for supply chain attacks. If an attacker registers a hallucinated package name, every project that imported it now pulls in attacker-controlled code.

What We're Looking For

If you've ever seen your AI assistant suggest packages like:

• express-helper-utils ❌
• react-dom-utils ❌
• lodash-extra-functions ❌
• mongoose-plugin-helper ❌

...or any other packages that turned out not to exist, please share them here!

Format

- Package name: `your-package-name`
- AI tool: (ChatGPT / Copilot / Cursor / Claude / other)
- Language: (JavaScript / Python / etc.)
- Context: (brief description of what you were building)

Current Database Stats

Metric	Count
Total hallucinated patterns	50+
Top hallucinated prefix	react-*
Languages covered	JavaScript, Python
Registry sources	npm, PyPI

How to Contribute

1. Comment on this issue with your examples
2. Or open a PR to packages/core/src/data/phantom-packages.json
3. Every contribution helps make AI-generated code safer for everyone

Related

• Show HN post — (coming soon)
• Documentation

---

Help us protect the next generation of AI-assisted development! 🛡️

[raye-deng]

📊 Phantom Package Database — March 2026 Update

Hey everyone! Here's a quick status update on the Phantom Package DB:

Current Stats

Metric	Count
Known hallucinated package patterns	44+
Detection engines	3 (L1 pattern match, L2 deep hallucination, L3 LLM-assisted)
Language registries	5 (npm, PyPI, Maven/Java, Go, Kotlin)
Total detector code	1,066 lines across 3 core modules

What's New Since Last Update

• 🆕 Hallucination fallback detection — catches AI-generated "graceful fallback" patterns that mask missing packages
• 🆕 Single-implementation abstraction detection — flags unnecessary wrapper patterns AI loves to generate
• 🆕 41 deprecated API patterns for React/Vue/Angular
• 🆕 9 AI-specific security anti-patterns (hardcoded secrets, eval injection, etc.)
• 🆕 Unicode invisible character detection — catches hidden characters AI sometimes inserts
• 🌍 Multi-language registry expansion — Java, Go, and Kotlin package registries now included

Recent Hallucination Examples We've Seen

These are the kinds of patterns our DB catches:

• express-helper-utils — classic "sounds real but doesn't exist" npm package
• react-dom-utils — plausible React ecosystem package
• mongoose-plugin-helper — AI loves generating *-helper and *-utils suffixes
• Phantom APIs like fs.readFileAsync() (doesn't exist in Node.js core)

🙏 We Need Your Help!

If you've encountered AI-hallucinated packages in your work, please share them here using the format in the issue description. Every contribution helps make the database more comprehensive and protects more developers.

Especially looking for:

• Python PyPI phantom packages
• Go module hallucinations
• Java/Kotlin Maven artifact hallucinations
• Any new npm patterns not yet in our DB

Together we can make AI-generated code safer! 🛡️