Imports of packages no manifest declares: a made-up name, or one never installed

Calls and packages that do not exist: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. lessloc catches it as made-up-api: checked against every package.json, Python manifest, the standard library and the project's own modules.

What makes imports of packages no manifest declares a bad practice?

The standards that call it a bad practice: Spracklen et al., USENIX Security 2025 (5.2–21.7% of recommended packages do not exist); OWASP Top 10 A03:2025 Software Supply Chain Failures.

What does lessloc do about imports of packages no manifest declares?

lessloc catches it as made-up-api: checked against every package.json, Python manifest, the standard library and the project's own modules.

• made-up-api (tier 1): Another language's API, such as null in Python, len() in JavaScript or None in Go, or an import that no manifest declares and the platform does not provide.

Related patterns

The other patterns in Calls and packages that do not exist:

• Another language's API: lessloc catches it as made-up-api.