**AI-aware dependency security scanner** ```bash pip install depfence depfence scan . ``` --- Traditional scanners match package versions against known advisories and stop there. That model misses three entire categories of attack that matter specifically to AI/ML developers. **AI/ML supply chain.** LLMs hallucinate package names. Attackers register those names with malicious payloads — a pattern called slopsquatting. Packages targeting `torch`, `langchain`, and `transformers` typos appear in th