…you installed a package the AI made up, and somebody had already registered the name.

The gotchaModels invent plausible package names and attackers register them ("slopsquatting"). Verify that every new dependency is real, maintained and the one you meant.