Apparently, criminals are taking advantage of ChatGPT's tendency to hallucinate. They're noting down non-existent imports, then they're creating malicious packages with those very same names.