so this is literally the same as the "vulnerability" of adding random dependencies from stack exchange without vetting, in practice
Reposted from David D. Levine
LLMs hallucinating nonexistent software packages with plausible names leads to a new malware vulnerability: "slopsquatting."

Comments