Unverified50% confidenceFactExact time
PyPI 历史上多次出现 typosquatting 攻击，恶意发布者注册与知名库名称相似的包名诱导开发者错误安装含恶意代码的包
1
Sources
50%
Confidence
Long-term
Relevance
7/6/2026
First Seen
Sources
Related Claims
Unverified历史上已有多起通过恶意VS Code扩展窃取开发者凭证的安全事件被报告65% similarUnverified攻击者利用AI幻觉出的包名，提前在npm、PyPI等包注册表抢注并植入恶意代码，这种攻击手法被称为slopsquatting61% similarVerifiedPrompt injection attacks induce AI agents to execute malicious operations by embedding text disguised as system instructions in code comments, documentation, web content, or even file names.60% similarUnverified许多组织通过 HackerOne、Bugcrowd 等漏洞赏金平台建立正式的 VDP（漏洞披露政策）59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/113633API
curl https://kongchang.com/api/v1/knowledge/claims/113633MCP
get_claim(id=113633)