How do you stop AI agents from pulling in fake NPM packages?

Had an AI tool invent a date library name that didn't even exist on NPM. It mocked the imports locally so tests passed fine but CI broke the moment we tried a real build.

Pretty scary how legit the fake package name looked. Now we run full fresh installs in sandbox containers before pushing anything.

Has an AI coding assistant ever hallucinated fake dependencies in your project? How are you catching them early?