Nthawi ina wothandizira AI akadzapereka malangizo pa phukusi loti liyikidwe, kodi mudzayang'ana ngati lilipodi? Opanga mapulogalamu ambiri satero. Kusiyana pakati pa malingaliro ndi kutsimikizira ndi komwe kumayambira ziwopsezo za slopsquatting, ndipo pasanathe zaka zitatu, chiwopsezocho chasintha kuchokera ku umboni wa lingaliro la wofufuza kupita ku kukhazikitsidwa kwa ma code akutali mkati mwa othandizira odziyimira pawokha. Nkhaniyi ikuwonetsa kusintha kwa slopsquatting ndi tanthauzo lililonse la magulu a AppSec ndi DevSecOps.
Chatsopano apa? Yambani ndi primer yathu yoyambira Kodi kugwedezeka ndi chiyani komanso momwe mungadzitetezere ku vutoli?, kenako bwererani kuti mudzawerenge nthawi.
Kuukira koyenda pang'onopang'ono m'ndime imodzi
Kuukira koyenda pang'onopang'ono imalembetsa phukusi loipa pansi pa dzina lomwe ma AI amalosera kuti lizioneka ngati zilombo. Kumene kulemba molakwika kumagwiritsa ntchito kulemba molakwika kwa munthu zofuna chifukwa zopempha, kusokoneza anthu kumagwiritsa ntchito chitsanzocho chokha popanga dzina lomveka bwino lomwe silikupezeka mu registry, kenako wowukira amanena dzina lenilenilo asanatchule aliyense wovomerezeka. Mawuwa adapangidwa ndi Seth Larson, Security Developer-in-Residence ku Python Software Foundation, ndipo adatchuka ndi Andrew Nesbitt. Chomwe chimapangitsa chitsanzochi kukhala choyenera kutsatiridwa ndi momwe chakulira mofulumira.
Kusintha kwa Slopsquatting
2023: chizindikiro choyamba cha chenjezo
Wofufuza za chitetezo Bar Lanyado adazindikira kuti ma LLM angapo amapitiliza kupereka malingaliro pa phukusi lotchedwa kukumbatirana nkhope-cli, chomwe sichilipo (chida chenicheni chimayikidwa ndi kukhazikitsa pip -U “huggingface_hub[cli]”). Pofuna kusonyeza chiopsezo, adayika phukusi lopanda kanthu pansi pa dzina loti lagona. Mkati mwa miyezi itatu linali litatsitsidwa nthawi zoposa 30,000, popanda kutsatsa kulikonse, ndipo dzina labodzalo linawonekeranso mu README ya malo osungiramo zinthu ogwirizana ndi kafukufuku wochokera ku kampani yayikulu yaukadaulo. Phukusilo linali lopanda vuto. Phunziro silinali: dzina logona liyenera kukhala lokhazikika mokwanira kuti wina aligwiritse ntchito.
2024: kuyambira pa positi ya blog mpaka nkhani zodziwika bwino
Mu Marichi 2024, The Register inanena za ma AI omwe amapanga molimba mtima mayina a mapulogalamu omwe opanga mapulogalamu anali kutsitsa, ena omwe mwina anali ndi pulogalamu yaumbanda. Kuphimbako sikunali kofunikira kwenikweni pa zomwe idavumbulutsa mwaukadaulo kuposa zomwe idawonetsa: kukumbatirana nkhope-cli Sichinalinso chinthu chongochitika kamodzi kokha koma chizindikiro choyamba cha dongosolo lalikulu mokwanira kuti atolankhani akuluakulu aukadaulo azindikire, patsogolo pa kafukufuku wamkulu yemwe angatsimikizire kukula kwake chaka chotsatira.
2025: muyeso woyamba wokhwima
Pepala la USENIX Security 2025 lakuti “We Have a Package for You!” (Spracklen et al.) linayesa mitundu 16 yopanga ma code, amalonda ndi otseguka, m'zitsanzo 576,000 za Python ndi JavaScript. Linasuntha kuchoka pa nkhani kupita ku deta:
- 19.7% ya ma phukusi omwe akulimbikitsidwa sanalipo.
- Ma model otseguka ankaona zinthu molakwika nthawi zambiri (21.7% pa avareji) kuposa amalonda (5.2%).
- Ochita zoipa kwambiri, CodeLlama 7B ndi 34B, adawona zinthu zobisika m'magawo oposa atatu a zotsatira zawo.
- Pa mitundu yonse, ofufuza adalemba mayina apadera opitilira 205,000 okhala ndi malingaliro osamveka bwino, gulu lalikulu lokwanira kulimbikitsa ma kampeni opitilira m'chilengedwe chonse.
Kafukufukuyu adagawanso momwe mabodza amapangira: 38% anali ma conflation omwe amaphatikiza mayina awiri enieni a phukusi (monga momwe adapangira pambuyo pake). kusintha kwa code kuchokera kusintha kwa jscode ndi react-codemod), 13% anali mitundu yosiyanasiyana ya ma phukusi enieni, ndipo 51% anali zongopeka zenizeni zomwe zili zomveka koma zopangidwa kwathunthu. Gulu loyamba limenelo ndi lofunika kwambiri poteteza, chifukwa dzina losokedwa pamodzi kuchokera ku zida ziwiri zenizeni ndilovuta kuliona pang'ono.
Chinthu chofunika kwambiri chomwe chapezeka kwa owukira: kuwona zinthu molakwika sikwachisawawa ndipo sikusintha pa kuyesa kulikonse. Ofufuza akabwerezabwereza mobwerezabwereza maulendo khumi aliwonse, 43% ya mayina omwe ali ndi malingaliro olakwika amaonekera pa kubwereza kulikonse ndipo 58% amabwerezabwereza kangapo. Wowukira safunika kuganiza. Amaona khalidwe la chitsanzo, amalemba mayina omwe amabwerezabwereza, ndikulemba kaye. Kubwerezabwereza kumeneko ndiko komwe kumasandutsa kuwona zinthu molakwika kamodzi kukhala kuukira komwe kungakulitsidwe.
2026: kuyambira ma phukusi odzipatula kupita ku othandizira odziyimira pawokha
Chaka chino chapereka umboni womveka bwino kwambiri wakuti kusokoneza sikungokhala kokha kwa wopanga mapulogalamu amene akukopera ndi kusindikiza zomwe zanenedwa. npm kukhazikitsa.
Mu Januwale 2026, wofufuza za chitetezo Charlie Eriksen adapeza phukusi la npm lokhala ndi zinthu zosayembekezereka, kusintha kwa code, kuti malangizo a othandizira opangidwa ndi AI anali atafalikira kale m'malo osungiramo zinthu 237 kudzera m'mafoloko, ndipo othandizira akuyeserabe kuyika tsiku lililonse. Inayamba mu imodzi commit za mafayilo a luso lolembedwa ndi AI omwe palibe munthu amene adawunikanso. Eriksen adalembetsa dzinalo yekha, podziteteza, wowukira asanaligwiritse ntchito ngati chida.
Payokha, phukusi loipa kwambiri lotchedwa zosagwiritsidwa ntchito, zolosera m'malo mwa zovomerezeka eslint-plugin-yosagwiritsidwa ntchito-imports, idapitiliza kujambula zoyika ngakhale npm itaiyika pansi pa chitetezo, kusonyeza nthawi yomwe kuukira kothamanga kungapitirire kupeza ozunzidwa pambuyo poti yalengezedwa.
Kenako, mu Julayi 2026, ofufuza adafotokoza njira yofanana yotchedwa "HalluSquatting" yomwe imalumikiza malingaliro ndi jakisoni mwachangu: wothandizira ma code a AI yemwe akutenga zinthu zomwe sizinachitikepo m'malo mwa wogwiritsa ntchito akhoza kugwiritsidwa ntchito kugwiritsa ntchito ma code omwe amaperekedwa ndi wowukira. Izi zimakulitsa kusintha kwa slopsquatting kuchokera ku chiopsezo chokhazikitsa passive kupita ku vector yogwira ntchito ya remote-code-execution mkati mwa ntchito zachitukuko cha agentic.
Chifukwa chiyani "vibe coding" yakulitsa malo owukira
Kuchepetsa ma code sikungakhale kofunikira kwambiri ngati ma code opangidwa ndi AI anali ochepa. Sikoyenera. Kukwera kwa othandizira kulemba ma code, ma agent odziyimira pawokha, ndi njira zogwirira ntchito za "vibe coding", komwe opanga mapulogalamu amawunikanso ma code ochepa asanayigwiritse ntchito, kwasintha malo owukira m'njira ziwiri zenizeni.
Choyamba, mfundo yoyambira si yongopanga mapulogalamu okha. Kuwukira kwa olemba kumadalira munthu m'modzi kulemba molakwika. Tsopano cholakwikacho chimayambira mkati mwa chitsanzocho ndipo chimafalikira kwa opanga mapulogalamu mazana ambiri omwe amafunsa mafunso ofanana ndi omwewo ndipo amalandira malingaliro omwewo omwe amangoganiza zinthu zopanda pake.
Chachiwiri, malo owukira adakwera pamwamba pa unyolo. Sikokwanira kungoyang'ana code yomwe munthu amalemba. Magulu ayenera kuyang'anira kudalira komwe wothandizira wa AI akuwonetsa, ma seva a MCP omwe amalumikiza, ndi othandizira omwe amayika ma phukusi opanda munthu m'njira yozungulira. AppSec Yachikhalidwe, yomangidwa kuti iwunikenso malo osungiramo zinthu ndi anthu. commits, sinapangidwepo kuti iwonetse kuyanjana pakati pa opanga mapulogalamu, AI, ndi registry, komwe ndi komwe kubisalira tsopano.
Kodi izi zikutanthauza chiyani popewa
Palibe chilichonse mwa izi chomwe chimapangitsa kuti AI yopangira zinthu ikhale yosatetezeka mwachibadwa. Izi zimayambitsa chiopsezo cha unyolo wopereka zinthu zomwe zida zachikhalidwe sizinapangidwe kuti zigwire, ndipo zimafuna mfundo zotsimikizira zomwe timagwiritsa ntchito kale pa kudalira kulikonse kwakunja: musadalire mwachisawawa, tsimikizirani gwero, ndikukhazikitsa kutsimikizirako m'malo modalira kukumbukira kwa wopanga aliyense. Buku lonse lothandizira chitetezo lili mu chitsogozo chathu cha Chitetezo cha unyolo woperekera zinthu za AI, koma mwachidule ndichakuti kutsimikizira pamanja, ngakhale kuli kofunikirabe, kumasiya kukula nthawi yomwe dzina losayembekezereka lingafikire opanga mapulogalamu ambirimbiri nthawi imodzi, kapena wothandizira akhoza kuyika popanda kuwunika kwa munthu.
Siyani ma phukusi osokonezeka maganizo musanayike wothandizira
Milandu ya 2026 ili ndi khalidwe limodzi: kukhazikitsa koopsa kumachitika popanda munthu m'njira yozungulira. Ndiwo mpata weniweni Xygeni Shield yapangidwira. Shield ndi chida chopepuka chomwe chimatseka ma phukusi oipa panthawi yokhazikitsa, pogwiritsa ntchito Chenjezo Loyambirira la Malware (MEW) zigamulo zomwe zimagwira ntchito musanasainidwe. Wothandizira AI kapena wothandizira wodziyimira pawokha akayesa kuyika phukusi lolembedwa mwatsopano, lokhala ndi malingaliro oipa, Shield imaiwunika momwe yatengedwera ndikuitseka, kotero script yokhazikitsa sigwira ntchito, kaya munthu anali kuiwona kapena ayi. Bloko lililonse limalowa mu zomwezo Xygeni console monga code yanu, kapangidwe, ndi zotsatira za nthawi yogwiritsira ntchito, ndi Shield imayenda limodzi ndi EDR yanu yomwe ilipo m'malo molimbana nayo.
Yambani kwaulere. Dongosolo la Xygeni's Developer ndi €0: malo osungiramo zinthu 10, ma scan 200 pamwezi, mpaka anthu 5 omwe amapereka, palibe khadi la ngongole. Sign up with GitHub, GitLab, kapena Google ndipo yambitsani scan yanu yoyamba mkati mwa mphindi zosakwana 10; Shield Chitetezo cha endpoint chikubwera ku dongosolo la Wopanga Mapulogalamu posachedwa.
FAQ
Kodi woyang'anira phukusi angalepheretse kugwedezeka yekha?
Osati kwathunthu. Kuzindikira kugundana kwa npm kumaletsa mayina ofanana kwambiri ndi ma phukusi omwe alipo, zomwe zimathandiza kupewa kulemba zolakwika, koma dzina lokhala ndi malingaliro ndi chingwe chatsopano chomwe sichingadziwike kugundana. Ngati wowukira alembetsa phukusi lokhala ndi malingaliro asanayike wopanga mapulogalamu, kukhazikitsa kumamalizidwa popanda cholakwika chifukwa phukusili lilipodi. Kupewa kumafunika kutsimikiziridwa kwa chiyambi ndi khalidwe la phukusili, osati kungoyang'ana kwa registry yokha.
Kodi n’chiyani chimapangitsa kuti milandu ya 2026 ikhale yosiyana ndi milandu ya slopsquatting yomwe inayamba kale?
Zochitika zakale zinkadalira kuti munthu akope ndikunama lamulo lokhazikitsa lomwe linkaperekedwa. Mu milandu ya 2026, ma agents odziyimira pawokha adayika kapena kuyesa kuyika ma phukusi okhala ndi malingaliro osawoneka popanda munthu kuwunikanso sitepeyo, ndipo njira ya HalluSquatting idapita patsogolo polumikiza malingaliro osawoneka bwino ndi jakisoni wofulumira kuti akwaniritse ma code akutali mkati mwa ntchito ya wothandizirayo.
