import { validate } from 'ajv-formats'; // ❌ Wrong package name import { validate } from 'ajv-formats'; // ❌ Wrong package name import { validate } from 'ajv-formats'; // ❌ Wrong package name // All of these look plausible. None of them exist on npm. import { parse } from 'json-parse-safe'; import { sanitize } from 'express-sanitizer-plus'; import { createClient } from 'redis-async'; import { hash } from 'bcrypt-fast'; // All of these look plausible. None of them exist on npm. import { parse } from 'json-parse-safe'; import { sanitize } from 'express-sanitizer-plus'; import { createClient } from 'redis-async'; import { hash } from 'bcrypt-fast'; // All of these look plausible. None of them exist on npm. import { parse } from 'json-parse-safe'; import { sanitize } from 'express-sanitizer-plus'; import { createClient } from 'redis-async'; import { hash } from 'bcrypt-fast'; const result = await axios.post(url, data); result.json(); // ❌ axios returns the response directly, not a .json() method // Should be: const result = await axios.post(url, data); result.data; // ✅ The actual response data const result = await axios.post(url, data); result.json(); // ❌ axios returns the response directly, not a .json() method // Should be: const result = await axios.post(url, data); result.data; // ✅ The actual response data const result = await axios.post(url, data); result.json(); // ❌ axios returns the response directly, not a .json() method // Should be: const result = await axios.post(url, data); result.data; // ✅ The actual response data const content = fs.readFileAsync('file.txt', 'utf-8'); // ❌ Doesn't exist // Should be: const content = await fs.promises.readFile('file.txt', 'utf-8'); // ✅ const content = fs.readFileAsync('file.txt', 'utf-8'); // ❌ Doesn't exist // Should be: const content = await fs.promises.readFile('file.txt', 'utf-8'); // ✅ const content = fs.readFileAsync('file.txt', 'utf-8'); // ❌ Doesn't exist // Should be: const content = await fs.promises.readFile('file.txt', 'utf-8'); // ✅ // Node.js — deprecated since v11, removed in v20 const parsed = url.parse(req.url); // ❌ // Express 5 — method was removed app.del('/resource', handler); // ❌ // React 19 — Concurrent mode APIs changed ReactDOM.render(<App />, rootElement); // ❌ Deprecated // Node.js — deprecated since v11, removed in v20 const parsed = url.parse(req.url); // ❌ // Express 5 — method was removed app.del('/resource', handler); // ❌ // React 19 — Concurrent mode APIs changed ReactDOM.render(<App />, rootElement); // ❌ Deprecated // Node.js — deprecated since v11, removed in v20 const parsed = url.parse(req.url); // ❌ // Express 5 — method was removed app.del('/resource', handler); // ❌ // React 19 — Concurrent mode APIs changed ReactDOM.render(<App />, rootElement); // ❌ Deprecated // user-service.ts (generated in one turn) export function getUser(id: string): Promise<User> { return db.query('SELECT * FROM users WHERE id = ?', [id]); } // auth-middleware.ts (generated in a separate turn) const user = await getUser(id, { includeRoles: true }); // ❌ Wrong signature // TypeScript error: Expected 1 arguments, but got 2 // user-service.ts (generated in one turn) export function getUser(id: string): Promise<User> { return db.query('SELECT * FROM users WHERE id = ?', [id]); } // auth-middleware.ts (generated in a separate turn) const user = await getUser(id, { includeRoles: true }); // ❌ Wrong signature // TypeScript error: Expected 1 arguments, but got 2 // user-service.ts (generated in one turn) export function getUser(id: string): Promise<User> { return db.query('SELECT * FROM users WHERE id = ?', [id]); } // auth-middleware.ts (generated in a separate turn) const user = await getUser(id, { includeRoles: true }); // ❌ Wrong signature // TypeScript error: Expected 1 arguments, but got 2 function calculateDiscount(price: number, tier: string): number { // 30 lines of discount calculation logic } // ... but this function is never called anywhere in the codebase function calculateDiscount(price: number, tier: string): number { // 30 lines of discount calculation logic } // ... but this function is never called anywhere in the codebase function calculateDiscount(price: number, tier: string): number { // 30 lines of discount calculation logic } // ... but this function is never called anywhere in the codebase # Simple check for npm packages for pkg in $(grep -roh "from ['\"][^'\"]*['\"]" src/ | sort -u); do npm view "$pkg" version >/dev/null 2>&1 || echo "⚠️ Package not found: $pkg" done # Simple check for npm packages for pkg in $(grep -roh "from ['\"][^'\"]*['\"]" src/ | sort -u); do npm view "$pkg" version >/dev/null 2>&1 || echo "⚠️ Package not found: $pkg" done # Simple check for npm packages for pkg in $(grep -roh "from ['\"][^'\"]*['\"]" src/ | sort -u); do npm view "$pkg" version >/dev/null 2>&1 || echo "⚠️ Package not found: $pkg" done // Example: validate that 'axios.post' is a real method import axios from 'axios'; console.log(typeof axios.post); // Should be 'function' // Example: validate that 'axios.post' is a real method import axios from 'axios'; console.log(typeof axios.post); // Should be 'function' // Example: validate that 'axios.post' is a real method import axios from 'axios'; console.log(typeof axios.post); // Should be 'function' # Check if used APIs match the installed version npx npm-check-updates --target minor npx depcheck # Check if used APIs match the installed version npx npm-check-updates --target minor npx depcheck # Check if used APIs match the installed version npx npm-check-updates --target minor npx depcheck // Build a map of exported function signatures // Cross-reference all call sites // Flag mismatches // Build a map of exported function signatures // Cross-reference all call sites // Flag mismatches // Build a map of exported function signatures // Cross-reference all call sites // Flag mismatches # .github/workflows/ai-code-check.yml name: AI Code Quality Check on: [pull_request] jobs: check-ai-defects: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Check for hallucinated imports run: | # Extract all import sources grep -roh "from ['\"][^'\"]*['\"]" src/ | \ sort -u | \ while read -r pkg; do # Skip relative imports [[ "$pkg" == .* ]] && continue # Check npm registry npm view "$pkg" version >/dev/null 2>&1 || \ echo "::error::Hallucinated import: $pkg" done # .github/workflows/ai-code-check.yml name: AI Code Quality Check on: [pull_request] jobs: check-ai-defects: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Check for hallucinated imports run: | # Extract all import sources grep -roh "from ['\"][^'\"]*['\"]" src/ | \ sort -u | \ while read -r pkg; do # Skip relative imports [[ "$pkg" == .* ]] && continue # Check npm registry npm view "$pkg" version >/dev/null 2>&1 || \ echo "::error::Hallucinated import: $pkg" done # .github/workflows/ai-code-check.yml name: AI Code Quality Check on: [pull_request] jobs: check-ai-defects: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Check for hallucinated imports run: | # Extract all import sources grep -roh "from ['\"][^'\"]*['\"]" src/ | \ sort -u | \ while read -r pkg; do # Skip relative imports [[ "$pkg" == .* ]] && continue # Check npm registry npm view "$pkg" version >/dev/null 2>&1 || \ echo "::error::Hallucinated import: $pkg" done # Install npm install -g open-code-review # Run against a PR ocr scan --source . --report json > ocr-report.json # Run in CI (fails on critical issues) ocr scan --source . --fail-on critical # Install npm install -g open-code-review # Run against a PR ocr scan --source . --report json > ocr-report.json # Run in CI (fails on critical issues) ocr scan --source . --fail-on critical # Install npm install -g open-code-review # Run against a PR ocr scan --source . --report json > ocr-report.json # Run in CI (fails on critical issues) ocr scan --source . --fail-on critical Code Commit → ESLint → Prettier → SonarQube → AI Defect Scanner → Deploy ↑ NEW LAYER Code Commit → ESLint → Prettier → SonarQube → AI Defect Scanner → Deploy ↑ NEW LAYER Code Commit → ESLint → Prettier → SonarQube → AI Defect Scanner → Deploy ↑ NEW LAYER - ✅ Code complexity and maintainability - ✅ Security vulnerabilities (SQL injection, XSS, etc.) - ✅ Code duplication - ✅ Bug patterns (null dereferences, unclosed resources) - ✅ Test coverage metrics - ❌ Whether imported packages exist on npm/PyPI - ❌ Whether method signatures match the actual library API - ❌ Whether API usage is version-appropriate - ❌ Whether cross-file contracts are consistent in AI-generated code - Free and open-source (MIT license) - Self-hostable — runs in your CI, no data leaves your infrastructure - Fast — completes in under 10 seconds for most repositories - Comprehensive — detects all five defect categories above - Hallucinated imports are the #1 most common AI code defect. They account for ~40% of all AI-generated code defects we detect. And traditional tools catch exactly zero of them. - The problem is getting worse, not better. As AI models get more confident, they hallucinate with more conviction. The code "looks more right" even when it's wrong. - Every team using AI coding tools needs this. Not "nice to have" — "need." The question isn't whether your AI will hallucinate an import. It's when, and whether you'll catch it before it reaches production. - Detection is cheap. Adding an AI-specific quality gate to your CI pipeline costs ~10 seconds per PR. The cost of missing a hallucinated import? Hours of debugging, potentially a production outage.