Fix the trust check for an AI-added npm package

Building a date feature, your AI assistant added date-helpers-lite to package.json. Models invent package names, and attackers register near copies of popular ones, called typosquats, so that installing one runs their install script. Your team now vets every dependency an assistant adds before anyone installs it.

An assistant wrote vet_ai_added_dependency(name, exists_on_registry, weekly_downloads, days_since_first_publish, has_source_repo, popular_names). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• name: the package name the assistant added.
• exists_on_registry: whether npm has a package with that name.
• weekly_downloads, days_since_first_publish, has_source_repo: the package's facts on npm.
• popular_names: the well-known packages your team recognizes.
• Return "hallucinated", "trusted", "typosquat" or "unvetted".

Rules the tests check, in order. Return the first that applies. Names are compared exactly, case included.

1. Not on the registry: "hallucinated".
2. name is exactly one of popular_names: "trusted".
3. name is within edit distance 2 of any name in popular_names: "typosquat". Edit distance is the fewest single-character insertions, deletions or substitutions that turn one name into the other. This check comes before any stats, because download counts are cheap to fake.
4. At least 10000 weekly downloads, at least 180 days since first publish, and a source repo: "trusted".
5. Anything else: "unvetted".