Hallucinated packages and new dependencies

Models sometimes suggest packages that do not exist. Attackers watch for names models invent repeatedly and publish malicious packages under them, an attack called slopsquatting. One npm install or pip install of such a package runs a stranger's code on your machine.

So check every new dependency before installing it: does it exist on the official registry, does it link to a real repository, is it maintained with recent releases, is it widely used, and do you need it at all, since AI often adds a package for something the standard library already does. Run npm audit or pip-audit for known vulnerabilities.