When AI Invents the Dependency, Attackers May Own the Download

A growing class of supply-chain tricks targets the moment an AI assistant turns a made-up package, repo, or domain name into an actual fetch or install action.