Slopsquatting解析：AI幻覺套件名成資安地雷 | Slopsquatting: AI Coding Agents Fuel Package Supply Chain Attacks

7月 27, 2026

By Kit 小克 | AI Tool Observer | 2026-07-28

🇹🇼 Slopsquatting解析：AI幻覺套件名成資安地雷

Slopsquatting是2026年最讓開發者頭痛的新型供應鏈攻擊：AI編碼助手一本正經地推薦一個根本不存在的套件名稱，駭客搶先把這個名字註冊上 npm 或 PyPI，等你或你的 AI Agent 順手裝下去，後門就跟著進了你的專案。這不是理論威脅，而是正在 GitHub、npm 上真實發生的攻擊手法。

什麼是 Slopsquatting？

傳統的 typosquatting（打字搶注）靠的是人類手滑打錯字，例如把 request 打成 requsts。Slopsquatting 完全不需要你打錯字——它利用的是 LLM 產生程式碼時「幻覺」出來的套件名稱。研究團隊在 USENIX Security 2025 測試 16 個模型、576,000 筆程式碼樣本後發現，幻覺套件裡有 51% 是憑空捏造，38% 是把兩個真實套件名混在一起，13% 是變體錯字。更麻煩的是，同一個提示詞重複問十次，其中 43% 的幻覺名稱每次都一樣——這代表攻擊者只要跑幾次同款提示詞，就能精準預測要搶註哪些名字。

已經有真實受害案例

資安研究員 Charlie Eriksen 就發現一個幻覺套件透過 AI 生成的 agent skill 擴散到 237 個儲存庫，靠著自動化 Agent 「自己生成、自己執行」的循環持續累積下載量。另一個案例中，一個叫 huggingface-cli 的幻覺套件因為出現在文件裡，三個月內吸引超過 3 萬次真實下載。

為什麼套件登記機制擋不住

npm、PyPI 這類套件平台的防護機制主要針對 typosquatting 設計，靠比對「看起來像不像常見套件的錯字」來攔截。但 Slopsquatting 生成的名字往往「聽起來完全合理」，不是錯字、不觸發相似度警報，防線因此形同虛設。當超過四成的提交程式碼已經有 AI 輔助參與，這個漏洞的曝險面只會越來越大。

開發者與團隊該怎麼防

裝套件前先查發布者與註冊時間，別只看下載數，新註冊、作者資訊空白的套件要特別小心
用 SCA（軟體組成分析）工具掃全套依賴樹，抓出從未見過、無合理來源的套件
CI/CD 裡限制 AI Agent 自動安裝套件的權限，強制要有人類確認才能執行安裝指令
對 AI 建議的套件名稱保持懷疑，尤其是 Agent 自動化編碼流程中沒有人在旁邊看的環節

好不好用，試了才知道。

🇺🇸 Slopsquatting: AI Coding Agents Fuel Package Supply Chain Attacks

Slopsquatting is the supply chain attack giving developers headaches in 2026: an AI coding assistant confidently recommends a package that doesn't exist, an attacker registers that exact name on npm or PyPI first, and the malware rides in the moment you — or your autonomous coding agent — run the install command. This isn't theoretical; it's already happening on GitHub and in package registries today.

What Is Slopsquatting?

Traditional typosquatting relies on a human fat-fingering a package name, like typing requsts instead of requests. Slopsquatting needs no typo at all — it exploits packages that LLMs hallucinate while generating code. Researchers who tested 16 models across 576,000 code samples for USENIX Security 2025 found 51% of hallucinated names were pure fabrications, 38% conflated two real package names, and 13% were typo variants. Worse: when the same prompt was run ten times, 43% of hallucinated names showed up in every single run — meaning an attacker only needs to replay a common prompt a handful of times to know exactly which names to squat.

Real Victims Already Exist

Security researcher Charlie Eriksen found a hallucinated package spreading through 237 repositories via an AI-generated agent skill, feeding on a loop where autonomous agents generate and then execute their own outputs. In another case, a hallucinated package named huggingface-cli picked up over 30,000 real downloads in three months simply because it appeared in someone's documentation.

Why Registry Defenses Don't Catch It

npm and PyPI's existing protections were built for typosquatting — flagging names that look like misspellings of popular packages. But Slopsquatting names typically sound entirely plausible, trigger no similarity alarms, and slip straight through. With over 40% of committed code now involving some AI assistance, this gap only gets wider.

How to Defend Against It

Check the publisher and registration date before installing, not just the download count — brand-new packages with no author history are red flags
Run software composition analysis (SCA) tools across the full dependency tree to catch packages with no legitimate provenance
Restrict autonomous package installs in CI/CD — require a human to confirm before an agent runs an install command
Treat every AI-suggested package name with skepticism, especially in unattended agentic coding pipelines

You won't know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士