Te raruraru i roto i te rerenga kotahi
A te wā e whai ake nei E taunaki ana te kaiawhina AI i tētahi mōkihi hei tāuta, ka tirohia e koe mēnā kei te wātea taua mōkihi? Kāore anō te nuinga o ngā kaiwhakawhanake kia pērā. Ko taua āputa i waenga i te whakaaro me te manatoko te wāhi tonu e tīmata ai ngā whakaekenga slopsquatting, ā, koia te take i noho ai te mārama ki te whanaketanga o te slopsquatting me te aukati mahi slopsquatting hei kaupapa matua mā ngā tīma AppSec me DevSecOps.
He aha te whakaekenga slopsquatting?
Ko te whakaeke slopsquatting he momo rerekē o te patopato (te mahi rēhita i tētahi ingoa rohe, ingoa mōkihi rānei e whai ana i tētahi ingoa tika mā te hē o te tuhi kupu, pērā i ngā tono hei utu mo o Tono, me te tumanako nā te hapa a te kaiwhakamahi ake i tuku tika atu ki te hapa), engari he rerekētanga nui kei hea te pūtake o te hapa. Ka whakamahia e te typosquatting ngā hapa pato tangata. Ka whakamahia e te whakaeke slopsquatting ngā hapa a ngā tauira reo nui: ka "whakaaroaro" te LLM i tētahi ingoa mōkihi e tangi tika ana engari kāore i roto i tētahi rēhita tūmatanui, ā, ka tae tuatahi te kaiwhakaeke mā te rēhita i taua ingoa tuturu i mua i te hunga whai whakaaro pai.
He māmā noa te tikanga o tētahi whakaekenga slopsquatting noa, ā, ko taua māmā tonu te mea e whai hua ai:
- Ka tono tētahi kaiwhakawhanake i tētahi kaiawhina AI hei āwhina i a ia ki te whakaoti rapanga waehere.
- Ka whakaputa te tauira i tētahi otinga e kawemai ana, e taunaki ana rānei kia tāutahia he mōkihi kāore anō kia tīariari.
- He kaiwhakaeke kua kite i te maha o ngā tauira e tukurua tonu ana i ngā rēhita ingoa moemoeā kotahi e tākai ana i runga i te npm, PyPI, i tētahi atu rēhita tūmatanui rānei, me te waehere kino kei roto. Koinei te wā ka huri te moemoeā hei whakaeke pōrearea tūturu.
- Ko te kaiwhakawhanake e whai ake nei, ka whiwhi i te whakaaro kotahi, ā, kāore i manatoko, ka tāuta i te mōkihi tūturu inaianei, he tatau muri tēnei ki roto i tō rātou taiao.
Nā Seth Larson, he Kaiwhakawhanake Haumarutanga-i-te-Rohe i te Python Software Foundation, i tito te kupu "slopsquatting", ā, i rongonuihia e Andrew Nesbitt, hei whakaahua i tēnei tauira: he "whakaaro pōkai" kua huri hei momo whakaeke.
Te whanaketanga koretake: me pēhea te tipu o te hiahia rangahau hei tūmomo mōrearea tūturu
Ko te mea whakamiharo mō te whanaketanga o te slopsquatting ehara i te ariā anake; engari ko te tere o te neke mai i te mātakitaki rangahau ki tētahi momo whakaeke kua tuhia, kua inehia.
2023: Te tohu whakatūpato tuatahi. Kairangahau haumarutanga a Bar Lanyado i kite i te maha o ngā LLM i tūtohu i tētahi mōkihi e kiia nei ko awhi-kanohi-cli, kāore i te tīariari (kua tāutahia te mōkihi tūturu me tāuta pip -U "huggingface_hub[cli]"). Hei whakaatu i te mōrearea, i tukuatu ia i tētahi putanga kau o taua mōkihi ki tētahi rēhita tūmatanui. I roto i ngā marama e toru, neke atu i te 30,000 ngā tangohanga kua riro mai, kāore he whakatairanga. I puta anō te ingoa moemoeā i roto i te README o tētahi putunga raraunga e hono ana ki ngā rangahau mai i Alibaba, e whakaatu wawe ana me pēhea te turuturu o ēnei ingoa "rūpahu" ki roto i ngā tuhinga tūturu, ā, ka whakatakoto i te atamira mō ngā whakaekenga tinihanga e whai ake nei.
2024: Ka neke te mōrearea mai i te pou rangitaki a te kairangahau ki te kapinga hangarau matua. I te Maehe 2024, Ko te Rehita i kōrero mō te āhua o te tito maia o ngā tauira AI i ngā ingoa mōkihi pūmanawa i tangohia e ngā kaiwhakawhanake i taua wā, ko ētahi o rātou i pangia pea e te pūmanawa kino. Kāore i nui te hiranga o taua kapinga mō ngā mea i whakakitea e ia i roto i te hangarau, engari mō ngā mea i tohuhia e ia: kāore te take huggingface-cli i te mea miharo noa iho; koinei te tohu tuatahi o tētahi tauira nui rawa atu mō ngā pāpāho hangarau matua ki te tohu, i mua i te rangahau mātauranga nui e whakaū ana i te whānuitanga i te tau i muri mai.
2025: Ko te inenga nui tuatahi o te raruraru. Ko te pepa "He Mōkihi Tā Māu! He Tātaritanga Whānui o ngā Mōhiti Mōkihi mā ngā LLM e Hanga Waehere ana" (Spracklen et al., i tukuna ki te Huihuinga Haumarutanga USENIX) i whakamātautau i ngā tauira whakaputa waehere 16, arumoni (GPT-4, GPT-3.5) me te pūtake tuwhera (CodeLlama, DeepSeek, WizardCoder, Mistral), puta noa i te 576,000 tauira waehere Python me JavaScript. E tohu ana ngā kitenga i tētahi wāhi mārama i roto i te whanaketanga o te slopsquatting, e neke ana mai i te pakiwaitara ki te raraunga:
- Kāore i te wātea te 19.7% o ngā mōkihi i tūtohutia e ngā tauira.
- He nui ake te maha o ngā whakaaro pohehe o ngā tauira tuwhera-pūtake (21.7% te toharite) i ngā tauira arumoni (5.2%).
- I roto i ngā tauira katoa i whakamatautauria, i tuhia e ngā kairangahau neke atu i te 205,000 ngā ingoa mōkihi moemoeā ahurei, he puna nui hei whakakaha i ngā whakaekenga parapara tonu puta noa i ngā pūnaha rauropi maha.
Ko tētahi kōrero nui o te rangahau, ā, koinei pea te take i tere ake ai te whanaketanga o te slopsquatting, kaua i memeha noa iho, ko te mea ehara ngā ingoa moemoeā i te mea tūpono noa, ā, kāore e rerekē i ia nganatanga. Ka tāruatia e ngā tauira kotahi ngā ingoa i hangaia ina tukuna he tohu rite, ko te tikanga kāore e hiahiatia e te kaiwhakaeke te whakaaro. Me mātakitaki noa rātou i te whanonga o te tauira, te tautuhi i ngā ingoa e puta tonu ana, me te rēhita i mua i te mahi a te kaiwhakawhanake tūturu. I kitea i roto i te tātaritanga whai muri o tēnei whakahokinga, i te wā i whakahaerehia anōtia ai e ngā kairangahau ngā tohu ōrite tekau ngā wā, 43% o ngā ingoa mōkihi moemoeā i puta i ia oma, he tohu ko te nuinga o ngā moemoeā he taonga ka taea te whakahoki, ehara i te haruru kotahi. Ko taua whakahokinga te mea e huri ai te moemoeā kotahi hei whakaeke slopsquatting tauine.
2026: Mai i ngā mōkihi motuhake ki ngā kaihoko motuhake. Mai i ngā mōkihi motuhake ki ngā kaihoko motuhake. I tēnei tau kua puta te taunakitanga mārama rawa atu, kāore te mahi tinihanga e herea ana ki te tārua-whakapiri a te kaiwhakawhanake i tētahi whakahau tāuta pip, tāuta npm rānei kua tūtohutia. I te marama o Hānuere 2026, i kitea e te kairangahau haumarutanga a Charlie Eriksen kua horahia kētia e ngā kaiwhakahaere waehere AI ngā tohutohu e pā ana ki tētahi mōkihi npm whakaarokore, react-codeshift (he ingoa e hono ana i ngā taputapu tūturu e rua, jscodeshift me react-codemod), puta noa i ngā putunga 237, me ngā kaiwhakahaere e ngana tonu ana ki te tāuta i ia rā. Nā Eriksen tonu i rēhita te ingoa, hei tiaki, i mua i te whakamahinga a te kaiwhakaeke. I tua atu, ko tētahi mōkihi kino tūturu ko unused-imports te ingoa, i whakaarokoretia hei whakakapi mō te eslint-plugin-unused-imports tika, kei te tuhi tonu i te 233 tango ia wiki i te tīmatanga o te tau 2026 ahakoa i whakanohoia e te npm ki raro i te pupuri haumarutanga, he tohu mō te roa o te whakaekenga tinihanga ka taea tonu te kukume i ngā patunga ahakoa kua tohua. Nō nā tata nei, i te marama o Hūrae 2026, i whakaahuahia e ngā kairangahau tētahi tikanga e pā ana, ko "HalluSquatting" te ingoa, e herea ana te moemoeā AI ki tētahi werohanga tere kia taea ai te kahakina tētahi kaihoko waehere AI e tiki ana i tētahi rauemi moemoeā mō tētahi kaiwhakamahi ki te whakahaere i te waehere i tukuna mai e te kaiwhakaeke, e whakawhānui ana i te whanaketanga o te slopsquatting mai i te mōrearea tāutanga kore mahi ki tētahi ara whakahaere waehere mamao hohe i roto i ngā rerengamahi whanaketanga kaihoko.
He aha i whakawhānui ake ai te "whakakōwae hihiri" i te mata mō ngā whakaekenga koretake
Kāore e nui te pānga o ngā whakaekenga slopsquatting mēnā he mahi motuhake te waehere i hangaia e te AI. Kāore. Ko te pikinga ake o ngā kaiawhina waehere, ngā kaihoko motuhake, me ngā rerengamahi "vibe coding", e iti haere ana te arotake a ngā kaiwhakawhanake i te waehere i mua i te whakahaere, kua nekehia te mata o te whakaeke pūmanawa i roto i ngā huarahi e rua, ā, e tere ake ana te whanaketanga o te slopsquatting i ngā huarahi e rua:
- Ehara i te kaiwhakawhanake anake te wāhi whakauru. I mua, ko te whakaekenga patopato i whakawhirinaki ki te tangata kotahi e hē ana te pato. Ināianei ka taea e te hapa te puta mai i roto i te tauira tonu, ka horapa ki ngā rau o ngā kaiwhakawhanake rerekē e pātai ana i ngā pātai ōrite, ā, ka whiwhi i te taunakitanga whakaaro pohehe ōrite, ka whakarea i te whānuitanga o te whakaekenga patopato kotahi.
- Kua neke ake te mata o te whakaeke i te mekameka. Kāore e ranea te mātakitaki noa i te waehere e tuhia ana e te tangata. Me mātakitaki anō hoki ngā tīma i ngā whakawhirinakitanga e tūtohutia ana e te kaiawhina AI, ngā tūmau MCP e hono atu ana, me ngā kaihoko e tāuta ana i ngā mōkihi motuhake me te kore he arotake tika a te tangata. Ko te AppSec tuku iho, i hangaia hei arotake i ngā putunga raraunga me te tangata commits, kāore i hangaia hei tirotiro i tēnei taunekeneke hou i waenga i te kaiwhakawhanake, te AI, me te rēhita mōkihi, koinei tonu te wāhi e huna ana ngā whakaeke slopsquatting.
Kāore tēnei e kī ana he kore haumaru te AI whakaputa. Ko tōna tikanga he whakauru mai i tētahi momo mōrearea mekameka tuku hou kāore i hangaia e ngā taputapu haumarutanga tuku iho hei hopu, ā, e hiahia ana ki ngā mātāpono manatoko ōrite e whakamahia ana e tātou ki tētahi whakawhirinakitanga o waho: kaua e whakawhirinaki mā te taunoa, manatokohia te pūtake, ā, aunoatia taua manatoko hei utu mō te whakawhirinaki ki te mahara, ki te mataara rānei o ia kaiwhakawhanake. Ko taua aunoatanga te tūāpapa o tētahi rautaki ārai tūkino tūturu.
Te ārai i te noho pōturi: ngā mea ka taea e ngā tīma te mahi i tēnei rā
Ko te rongo pai, kāore e hiahiatia he taputapu tauhou mō te ārai i te noho pōrearea. Me whakamahi pūnaha i ngā tikanga akuaku whakawhirinakitanga kua wātea kē, engari he maha ngā tīma ka whakangāwari i te wā e "whakaarohia" ai te waehere e te AI e whakawhirinakihia ana e rātou. Ko te tikanga he whakakotahi i ēnei e whai ake nei te huarahi ārai i te noho pōrearea whai hua:
- Manatoko ā-ringa i tētahi mōkihi hou i mua i te tāutanga, inā koa ka ahu mai i te whakaaro a te kaiawhina AI. Whakaūtia kei roto i te rēhita mana, ko wai e pupuri ana, i te wā i whakaputaina ai, me te āhua tūturu o ana tau tango. Ko tēnei whanonga kotahi te momo ārai iti rawa te utu e wātea ana ki tētahi tīma.
- Kaua rawa e whakaaro he haumaru te waehere i hangaia e te AI i te taunoa. Ahakoa he "mahi" te wāhanga waehere, ehara i te mea he tika ōna whakawhirinakitanga. Me whai wāhi te arotake whakawhirinakitanga ki te arotake waehere, kaua e waiho hei okotahi.
- Whakamahia ngā kōnae maukati me te manatoko hash hei pine i ngā putanga tuturu, hei aukati hoki i te whakawhiti o tētahi whakahōu puku ki tētahi mōkihi rerekē i tērā i arotakehia tuatahitia.
- Whakatakotoria te matawai whakawhirinakitanga e tohu ana i ngā tauira mōrearea kei tua atu i ngā CVE e mōhiotia ana: ngā mōkihi rerekē, ngā ingoa e āhua rite ana ki ngā mea o nāianei, ngā kaiwhakahaere hou kāore he hītori mahi, ngā tuhinga tāuta rānei me ngā whanonga rerekē. Ko tētahi mōkihi hou kua whakaputaina me te kore hītori e tata ana ki te whai i te ingoa o tētahi mea "tata" mōhiotia koinei tonu te tauira i muri i te nuinga o ngā whakaekenga koretake kua tuhia tae noa ki tēnei wā.
- Me whakahaere ngā rēhita tūmatanui me te whakaaro kotahicism pērā i tētahi atu puna o waho kāore anō kia manatokohia. Ko te meka pip tāuta or npm tāuta kāore e maka he hapa ehara i te tohu o te tika.
- Whakangungu i ngā tīma whakawhanake nā te mea kāore te waehere āwhina-AI e tango i te kawenga ki te manatoko i ngā mea kua tāutahia; engari ka tāpirihia he taahiraa me whakauru ki roto i te tukanga mahi hei wāhanga o tētahi mahere ārai hapa nui.
Kāore tētahi o ēnei mehua i te mea hou i a ia anō. Ko te mea kua rerekē ko te tauine: ina kore te whakaaro whakawhirinakitanga e ahu mai i Stack Overflow, i tētahi hoa mahi rānei, engari mai i tētahi tauira ka taea te whakahoki i te hapa whakaaro kotahi ki ngā mano tini o ngā kaiwhakawhanake rerekē, ka mutu te manatoko ā-ringa, ahakoa e tika ana, i te ranea i a ia anō. Koia te take he maha atu ngā tīma e whakahaere aunoa ana i tēnei paparanga o te aukati i te mahi hē i roto i ā rātou ake. Tātaritanga Hanganga Pūmanawa (SCA) taputapu, kaua e waiho mā te kaiwhakawhanake takitahi e whakatau.
Ko tēnei te muacishe aha ai ASPM mahere rite Xygeni hanga i te kitenga whakawhirinakitanga whakapae, e kapi ana i te hapa pato, te whakapoauau whakawhirinakitanga, me ngā mōkihi kino e mōhiotia ana, ki roto i te tātari pūtake tuwhera me te tātari whakawhirinakitanga AI kotahi pipeline, nō reira, kāore te aukati i te mahi hē e whakawhirinaki ki te mahara o ia kaiwhakawhanake ki te tirotiro i ia wā ka whakaarohia e te kaiawhina AI he whakawhirinakitanga hou.
FAQ
He rite tonu te whakaeke slopsquatting ki te whakaeke typosquatting?
Kāore rawa. Ko ngā mea e rua e pā ana ki te rēhita i tētahi ingoa mōkihi rūpahu hei tinihanga i te tangata e tāuta ana, engari he rerekē te pūtake o te hapa. Ka whakamahia e te typosquatting ngā hapa pato a te tangata. Ka whakamahia e te whakaeke slopsquatting ngā ingoa mōkihi i hangaia (he moemoeā) e ngā tauira AI, ka rēhitahia e te kaiwhakaeke i mua i tōna tūnga tika.
Ka taea e te kaiwhakahaere mōkihi te aukati aunoa i tēnei momo whakaeke?
Kāore i te tino oti, koia tonu te take e kore ai e mutu te aukati i te mahi tinihanga i te taumata kaiwhakahaere mōkihi. Mena ka rēhitahia e te kaiwhakaeke te mōkihi i mua i te ngana a te kaiwhakawhanake ki te tāuta, ka oti te tāutanga me te kore he hapa nā te mea kei te noho tonu te mōkihi, ahakoa he kino. Me whakamana anō te aukati whai hua i te takenga mai me te whanonga o te mōkihi.
Ka pāngia anake ngā tauira pūtake tuwhera e tēnei?
Kāo. I kitea e te rangahau a Spracklen me ētahi atu he moemoeā puta noa i ngā tauira katoa i whakamatautauria, tae atu ki ngā tauira arumoni, engari he iti iho te tere (5.2% ki te 21.7% mō ngā tauira tuwhera-pūtake i arotakengia). Kāore he tauira e kore rawa i te raruraru, koinei tētahi o ngā take e rite tonu ai te whanaketanga o te slopsquatting ki te tipu haere o te waehere āwhina-AI whānui.
He mōrearea ā-arotake tēnei, kua whakamahia kētia rānei?
te awhi-kanohi-cli Hei tauira, i tukuna ake he mōkihi kau i tukuna ake e tētahi kairangahau i tangohia ake i te 30,000 ngā wā i roto i ngā marama e toru, kāore he whakatairanga, e whakaatu ana ehara i te mea he ariā noa iho te mōrearea: me rite tonu te ingoa moemoeā puta noa i ngā tohu rerekē kia taea ai e te tangata te huri hei whakaeke tinihanga tūturu.
