Sometimes LLMs generate fake package names. Attackers know this, and publish fake packages under these hallucinated names.