“In a recent study, researchers found that about 5.2 percent of package suggestions from commercial models didn’t exist, compared to 21.7 percent from open source or openly available models.”
About 5% of packages suggested by commercial models do not exist, and 22% from open models. Many of the fake names come back on every run. Attackers register them and wait. Anyone who installs what the assistant suggests gets whatever the attacker uploaded.