DEV Community

golproductions
golproductions

Posted on • Originally published at golproductions.com

Your AI Is Importing Packages That Don't Exist

#programming #ai #productivity #security

Every AI coding agent does this. It writes a line of code that looks perfect — clean syntax, reasonable logic, exactly what you asked for. Except the import at the top of the file references a package you've never installed. The code breaks the moment it runs.

The problem is structural, not behavioral

When an AI model generates code, it draws from patterns in its training data. If it has seen import cache from "express-redis-cache" used in thousands of codebases, it will suggest it in yours — regardless of whether that package is in your package.json.

The model has no access to your dependency tree. It doesn't read your node_modules. It doesn't know what's installed. It generates what looks right based on statistical patterns, not based on your project.

This is not a bug in the model. It's a fundamental limitation. The model generates code in isolation from your project state.

What this looks like in practice 

// AI writes this
import redis from "express-redis-cache";
import { rateLimit } from "express-rate-limiter";
import morgan from "morgan-body";

// Your package.json has none of these
// MODULE_NOT_FOUND: Cannot find module 'express-redis-cache'
Enter fullscreen mode Exit fullscreen mode

The names sound right. They follow naming conventions. Some of them are real packages — just not ones you have installed. Others are completely invented. The model doesn't distinguish between the two.

This is especially common when the AI is writing boilerplate, middleware chains, or utility code. These are the contexts where models have seen the widest variety of packages during training, so the pool of possible suggestions is deepest — and least likely to match your specific setup.

Why this costs more than you think

A hallucinated import doesn't just fail once. Here's the chain:

  1. AI writes a file with a wrong import
  2. You run the code (or your agent does)
  3. It crashes with MODULE_NOT_FOUND
  4. The AI sees the error and tries to fix it
  5. It either suggests installing the package (wrong fix) or rewrites the import to another package it thinks might work (another guess)
  6. The cycle repeats

Each retry is another inference call. The context window grows with each error. The cost compounds. A single hallucinated import can trigger 3-5 retries before the AI either finds the right package or you intervene manually.

The fix: verify imports against your actual project

Check reads your actual package.json after every file write. Every import and require() in the generated code is compared against your real dependencies. If the AI wrote an import for a package you don't have, it gets flagged before the code ever runs.

npx @golproductions/check --install your_key
Enter fullscreen mode Exit fullscreen mode

One command. The AI keeps writing code. Check keeps verifying it matches your project. No AI inside Check — it's deterministic. It reads your dependency list and compares. Same input, same output, every time.

Works with Claude Code, Cursor, and Antigravity. 120 free checks on signup. $0.0068 AUD per check after that. No subscription. Credits never expire.

FAQ

Why does AI hallucinate imports?
AI models generate code based on patterns from training data, not your actual project. They don't have access to your package.json or node_modules. If the model has seen a package used in similar contexts during training, it will suggest it — whether you have it installed or not.

How do I stop AI from importing packages I don't have?
Install Check (npx @golproductions/check --install your_key). After every file write, Check compares the imports in the generated code against your actual package.json dependencies. If the AI wrote an import for a package you don't have, it gets flagged.

What happens when AI imports a non-existent package?
If the code reaches production, it crashes at runtime with MODULE_NOT_FOUND. If caught during development, you waste time debugging why the AI's suggestion doesn't work and manually fixing the imports.

Does Check work with TypeScript imports?
Yes. Check validates imports in JavaScript, TypeScript, JSX, TSX, and all Node.js module formats (ESM and CommonJS). It compares every import and require() against your actual dependencies.

Top comments (0)