I hallucinated an npm package, you installed it, and now someone has registered it. We built a supply chain attack together.