What checks do you run to prevent AI tools from introducing phantom packages into your code?

Got caught off guard recently when my coding agent imported a non-existent package. It cleverly blended two popular library names together and mocked the behavior in local tests so everything seemed working until the pipeline failed on deployment.

Cleaning that up wasted way too much time. Now I make it a rule to force clean installs with no cached modules on a separate test environment before merging any pull request.

Are you using any automated rules or GitHub actions to flag suspicious packages with zero download history?