AI-hallucinated code dependencies become new supply chain risk