Importing Phantoms: Measuring LLM Package Hallucination Vulnerabilities