Slopsquatting
A model invents a package name that sounds right. It fails to install, and that's a clue. Then somebody notices the invented name and registers it with their own code, and now the same mistake installs without a murmur.
The name only needs to be guessed once by an attacker and repeated by a model. An agent that installs what it thinks exists is how that turns into code running on your machine, with nobody having chosen it.
Say it to your agent
“Before you add a package, show me its registry page, first publish date and weekly downloads. If you can't find it, or it's less than 30 days old, stop and tell me. Don't install it to see whether it works.”