Import of a package nothing installs

An import with no matching installed package: the offline sign of a hallucinated dependency.

Check dependency-riskShip CheckJavaScript, TypeScript, Python

Why it matters

Models sometimes import packages that do not exist, choosing a name that sounds right for the job. Because the package was imagined, the agent never added it to the manifest either. The same gap appears for ordinary reasons too: the agent ran the code in an environment that already had the package, or skipped the install step.

In a clean environment the import fails on first run, which in interpreted stacks means at runtime rather than at build time. The worse case is installing the missing name without checking it: invented package names repeat across runs, and attackers register them.

Example

 import { z } from "zod";
+import { parsePhone } from "@acme/phone-utils";
 export const signupSchema = z.object({
   email: z.string().email(),
+  phone: z.string().transform(parsePhone),
   password: z.string().min(12),
 });

What it detects

• New JavaScript and TypeScript imports, requires and dynamic imports, and Python imports, in source and test files, whose package is not in package.json (including workspace manifests), requirements files, pyproject.toml, Pipfile, setup.py, setup.cfg or environment.yml.
• Relative paths, path aliases (@/ and ~), node: and bun: specifiers, Node and Python standard library modules, workspace package names and local Python modules are ignored. Common import and distribution name differences (yaml and pyyaml, PIL and pillow, cv2, sklearn, bs4) are handled.
• Rated lower when another package from the same npm scope is declared, since that usually means a transitive dependency rather than an invented name.
• Also flags dependency lines changed in package.json with no lockfile change.
• No network lookup is made, and the check stays silent when it cannot find any manifest.

What to do when it fires

Look up each flagged name on the registry before installing anything. Confirm it exists, is maintained, and is the package you meant, not a similarly named one. If it does not exist, replace the import with a real library or write the function yourself.

Once the package is confirmed, add it with your package manager so the manifest and lockfile update together, and commit both.