I had already heard about malware distributors registering common misspellings of package names on Pypi or Conda to lure developers into importing their malicious code as a library, but felt this should be a relatively small risk in most cases. But I see how one can use a LLM to generate millions of import statements and then systematically screen those for hallucinated package names to register.