AI coding agents are installing packages no one owns · HackerTrans