Supply Chain
Slopsquatting
Also: package hallucination attack
Registering package names that AI models tend to hallucinate, so that a developer or agent who installs the made-up name gets malware.
In more detail
Language models sometimes recommend libraries that do not exist. If the same fake name comes up repeatedly, an attacker can publish a real package under it. A coding agent that installs without checking will pull it in. Verify that a package exists, is established and matches what you intended before installing.