Tel AvivResearchers found 120 sites with fake install commands.
A few dozen companies, some Fortune 500, ran the unclaimed code.
Coding agents read vendor install guides as instructions, so whoever claims an unregistered package name first gets code execution.
The other 119 misconfigured sites have not been named or fixed.
Sources: Ars Technica