# Imports of packages no manifest declares: a made-up name, or one never installed

*Calls and packages that do not exist*: one of the ways AI coding agents bloat software, from lessloc's [pattern catalog](https://lessloc.org/patterns/index.md). lessloc catches it as [`made-up-api`](https://lessloc.org/guide/reference.md#tier-1): checked against every package.json, Python manifest, the standard library and the project's own modules.

## What makes imports of packages no manifest declares a bad practice?

The standards that call it a bad practice: Spracklen et al., USENIX Security 2025 (5.2–21.7% of recommended packages do not exist); OWASP Top 10 A03:2025 Software Supply Chain Failures.

## What does lessloc do about imports of packages no manifest declares?

lessloc catches it as [`made-up-api`](https://lessloc.org/guide/reference.md#tier-1): checked against every package.json, Python manifest, the standard library and the project's own modules.

- `made-up-api` (tier 1): Another language's API, such as `null` in Python, `len()` in JavaScript or `None` in Go, or an import that no manifest declares and the platform does not provide.

## Related patterns

The other patterns in [Calls and packages that do not exist](https://lessloc.org/patterns/index.md#calls-and-packages-that-do-not-exist):

- [Another language's API](https://lessloc.org/patterns/wrong-language-api.md): lessloc catches it as `made-up-api`.