1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That You ask an AI coding assistant for help. It writes the code and the requirements.txt . You pip install -r requirements.txt . And one of those package names? The AI made it up. Research presented at USENIX Security 2025 measured this at scale: across 2.23 million package references produced by 16 large language models, 19.7% pointed to packages that were never published . Attackers know this too — they regist...