LLMs will happily copy-paste malware or add them as dependencies