How to Defend AI Coding Agents Against HalluSquatting Attacks

HalluSquatting turns predictable AI hallucinations into malware delivery. Why lockfiles and cooldowns do not stop it, plus the PreToolUse hook, sandbox config, and .npmrc settings that do.