[woodruffw]

You've always been able to make "believable" packages at scale. PyPI doesn't enforce uniqueness: you can crank out malicious near-duplicates of any package you please.

[zeven7]

And, to parent's point, now LLMs will tell people to use them and they will[1].

[1] https://news.ycombinator.com/item?id=34916682

[Groxx]

Stack Overflow and Google search results were already doing that though, at massive scale. I agree it changes things somehow, but people not thinking before acting is not a new problem.