English(EN) Names Can Hurt: Spotting Slopsquatting Risks Caused by Package Name Hallucinations in Local Coding LLMs

LLM包名幻觉带来供应链风险，新型检测器旨在缓解

作者 PulseAugur 编辑部 · [1 个来源] · 2026-08-26 04:00

研究人员发现本地编码LLM中存在一个重大的安全风险，即模型会产生包名幻觉，从而可能导致被称为“Slopsquatting”的供应链攻击。一个提议的两层检测系统，结合了PyPI存在性检查和随机森林分类器，旨在缓解此问题。该系统集成到一个LangGraph状态机中，该状态机可以在更高温度下重试生成或切换到备用模型。用户研究表明，用户对所提出的解决方案感到满意，并有很高的采用意愿。 AI

影响缓解了LLM代码生成带来的供应链风险，提高了软件开发管道的安全性。

排序理由该集群包含一篇学术论文，详细介绍了一种检测LLM生成代码中安全风险的新方法。[lever_c_demoted from research: ic=1 ai=1.0]

在 arXiv cs.AI 阅读 →

AI 生成摘要 · Google Gemini · 来自 1 个来源。我们如何撰写摘要 →

本文如何被排名

Signal score: 45 / 100; Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket: Tool; 该集群包含一篇学术论文，详细介绍了一种检测LLM生成代码中安全风险的新方法。[lever_c_demoted from research: ic=1 ai=1.0]
Source corroboration: Single-source cluster; Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics: paper, safety, product; Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance: High; Clearly on-topic for AI-industry coverage.
Story freshness: Breaking (< 6h); Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

完整方法见我们的编辑标准。

报道来源 [1]

arXiv cs.AI TIER_1 English(EN) · Akash Raj, Sargam Sahu · 2026-08-26 04:00

名字可能伤人：识别本地编码LLM因包名幻觉导致的Slopsquatting风险

arXiv:2608.23897v1 Announce Type: cross Abstract: When a code generating language model fabricates a Python package name, an adversary who has pre-registered that name on PyPI can convert that hallucination into a supply chain compromise. This event has been termed as 'slopsquatt…

本文如何被排名

报道来源 [1]

名字可能伤人：识别本地编码LLM因包名幻觉导致的Slopsquatting风险

相关实体

相关话题