AI bots hallucinate software packages and devs download them
www.theregister.com
Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don't do that