# Can I trust the package name my AI coding assistant suggested?

Not without a check, and this is becoming a primary attack vector. **AI coding assistants confidently invent package names** that either do not exist or point at typosquats, and attackers have started **registering typosquats for common AI-hallucination strings**. So the install command an assistant hands you can point straight at a malicious package.

The uncomfortable part: **your other defenses do not cover this.** A [cooldown window](https://www.tigzig.com/agents-faq/how-to-protect-against-a-poisoned-npm-release) does nothing, because a typosquat is a brand-new package rather than a poisoned release of a trusted one. [Postinstall blocking](https://www.tigzig.com/agents-faq/should-i-block-npm-postinstall-scripts) helps, but only if it is already on. The safe move is simply not installing the bad package in the first place.

**The 30-second check**, before installing anything new: open the npm or PyPI page directly; look at the publisher, the download count, and whether the linked repo has real history; then compare the name **character by character** against the well-known one (`reqeusts` vs `requests`, `lodahs` vs `lodash`). If an AI suggested it, ask whether this is what the AI actually *meant*. Skim the README and the source link.

The rule worth internalising: **treat an AI-suggested install command exactly like AI-suggested SQL.** Never run it blind, always read it first. Do not skip the check because the assistant sounded confident - confidence is not evidence, and this is a 30-second check that closes the entire attack class.

Layered defense: [https://www.tigzig.com/agents-faq/how-to-protect-against-a-supply-chain-attack](https://www.tigzig.com/agents-faq/how-to-protect-against-a-supply-chain-attack). Full item: [https://www.tigzig.com/security/supply](https://www.tigzig.com/security/supply).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/can-i-trust-the-package-my-ai-assistant-suggested
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms