... Something I keep thinking about while building LineageLens Trellis: LLMs hallucinate package names *consistently*. The same fake names recur across models and prompts. Attackers have started harvesting those names and registering them on npm/PyPI with malicious install hooks so when the next agent hallucinates `fastapi-utils-extra`, the install *succeeds*. The part that unsettles me is that it beats code review completely. The import looks normal, the lockfile resolves, nothing in the diff is wrong. The malicious code ... ... introduces an unexpected package, I'd like to know which agent session suggested it, why it entered the workflow, and whether it passed basic trust checks before installation. I see registry scanners and provenance as complementary layers rather than alternatives

... They don't have time for CRM + email sequences AI agent runs the whole playbook Launching on PH today. Curious what the SaaS crowd thinks. https://www.producthunt.com/prod... Comment from Carly Cauthen(@carly_cauthen): Hi Product Hunt! I built Trellis because I watched 60% of salons, cleaning companies, and service businesses lose loyal customers to silence not dissatisfaction. One missed appointment reminder or birthday check-in, and customers ghost. Trellis