研究称 AI 编程助手推荐不存在的包，建议进行安全预检

On November 6, 2026, DEV Community's AI channel published a write-up on a study examining AI coding assistants that recommend third-party packages which do not exist. The study, titled "We Have a Package for You!

" (arXiv 2406.10279), found that across 576,000 code samples, 19.7% of the recommended third-party packages did not actually exist, and that 58% of the hallucinated package names repeated across multiple runs. Because these names recur, the report notes, they can be registered by an attacker in advance, a practice the report refers to as "slopsquatting." The article also states, citing Wikipedia, that as of July 2026 no real-world attacks had been reported, so the issue should be treated as a cheap precaution rather than a proven emergency. On mitigation, the article advises developers to verify the authenticity of dependency packages before building code, either via a low-cost pre-install check or through free tools such as Socket's extension. Based on the material available, the story stands at the point where the risk has been documented by research but confirmed attacks remain absent.