The AI imported a package that doesn't exist ("module not found")
Any AI coding tool Last checked 2026-10-14
The model invented a plausible-sounding library. It is called package hallucination, and it is normal: models predict likely text, and a tidy name like react-use-debounce-hook looks exactly like a real package. Verify the package exists on the registry before you install it — and never install a hallucinated name on faith, because attackers deliberately register the common ones.
What you saw
Error: Cannot find module 'react-use-form-validator'
ModuleNotFoundError: No module named 'openai_helpers'
Your app or script crashes on an import the AI wrote. The name looks completely reasonable. Searching npm or PyPI returns nothing, or returns something with a suspiciously small number of downloads and no repository link.
A variation that is harder to spot: the package is real, but the *function* the AI called on it does not exist, or was removed several versions ago.
What it actually means
Language models generate the most statistically plausible next tokens. A package name that follows a familiar naming pattern is highly plausible whether or not anyone ever published it.
This gets worse with newer or niche ecosystems, where the model is pattern-matching against a thin slice of training data, and with anything released after the model's training cutoff.
The security part matters. Because models hallucinate the *same* convincing names repeatedly, there is a known supply-chain attack — sometimes called slopsquatting — where someone registers those names and ships malware. So npm install <name the AI gave you> succeeding is not proof the package is legitimate.
The same mechanism produces hallucinated *methods* on real libraries. The import works, the call fails.
The fix
Check the registry before installing anything. If it does not resolve, it does not exist.
npm view react-use-form-validator
pip index versions openai_helpers
If it does resolve, look at weekly downloads, last publish date and whether it links to a real repository. A package first published last week with 40 downloads and no source link is a red flag, not a dependency.
Ask the model to work from what you actually have installed instead of from memory:
Only use packages already in package.json. If you need a new one, stop and tell me the name and why, and do not write the import yet.
For a hallucinated method on a real package, point the model at the installed version's actual API rather than arguing with it:
Read node_modules/<pkg>/README.md (or the .d.ts types) and use only methods that exist in the installed version.
Replace it with the real equivalent. Most hallucinated helper packages are either a well-known library under a different name, or fifteen lines you can write inline — which is usually the better answer.
How to stop it happening again
Add a rule to your project rules / CLAUDE.md / system prompt: no new dependencies without asking first, and never import a package that is not already in the manifest.
Pin and commit your lockfile. Review every dependency change in the diff, the same way you would review code.
Prefer the standard library and packages you already use. Every AI-suggested micro-dependency is a maintenance and security cost you did not have before.
Install from a clean lockfile in CI (npm ci, pip install -r requirements.txt) so a package that only exists on someone's laptop fails loudly and early.
Related questions
Why does the AI sound so confident about a package that doesn't exist?
Confidence is a property of the writing style, not of the knowledge. The model has no mechanism to check a registry while generating text, so a false name is produced in exactly the same tone as a true one.
Is it safe to just install it and see?
No. Installing an unknown package runs its install scripts. Attackers register commonly hallucinated names for precisely this reason. Check the registry listing first.
The import exists but the function doesn't. Same problem?
Same root cause. The model is recalling an API shape that is plausible or outdated. Have it read the installed package's types or README and work from that.