{
  "format": "agent-article-v0",
  "article_id": "EA-685",
  "canonical_url": "/tools/ea-685-coding-agent-dependency-hallucination-slopsquatting",
  "page_type": "failure_note",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-685-URL-8E1C83EAF1DC",
    "EVD-EA-685-URL-4693A7218558",
    "EVD-EA-685-URL-AE875C4A049E",
    "EVD-EA-685-URL-B533BC778486",
    "EVD-EA-685-URL-0869A4CCDB56",
    "EVD-EA-685-URL-A7A8FFF2D41F",
    "EA-685-R11-RESEARCH",
    "EA-685-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-685-UNKNOWN-01"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "CURRENT",
  "observation_status": "SPEC_ONLY",
  "freshness": "CURRENT",
  "last_verified": "2026-10-04",
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "EA-685-FIRST-WORK-20261004",
    "SRC-EA-685-URL-8E1C83EAF1DC",
    "SRC-EA-685-URL-4693A7218558",
    "SRC-EA-685-URL-AE875C4A049E",
    "SRC-EA-685-URL-B533BC778486",
    "SRC-EA-685-URL-0869A4CCDB56",
    "SRC-EA-685-URL-A7A8FFF2D41F",
    "WEBBODY-EA0685-R8-3AD4C31F"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-685-URL-8E1C83EAF1DC",
      "evidence_class": "RESEARCH",
      "title": "S1: Spracklen et al., USENIX Security 2025, §5.3 —",
      "href": "https://www.usenix.org/system/files/usenixsecurity25-spracklen.pdf",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-685-URL-8E1C83EAF1DC"
      ],
      "supporting_locators": [
        "SOURCES",
        "S1",
        "- S1: Spracklen et al., USENIX Security 2025, §5.3 — https://www.usenix.org/system/files/usenixsecurity25-spracklen.pdf"
      ],
      "scope": "SOURCES",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-685-URL-4693A7218558",
      "evidence_class": "RESEARCH",
      "title": "S3: Churilov, 2026 preprint v3（要旨確認のみ）—",
      "href": "https://arxiv.org/abs/2605.17062v3",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-685-URL-4693A7218558"
      ],
      "supporting_locators": [
        "SOURCES",
        "S3",
        "- S3: Churilov, 2026 preprint v3（要旨確認のみ）— https://arxiv.org/abs/2605.17062v3"
      ],
      "scope": "SOURCES",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-685-URL-AE875C4A049E",
      "evidence_class": "RESEARCH",
      "title": "S4: pip Secure installs v26.2.1 —",
      "href": "https://pip.pypa.io/en/stable/topics/secure-installs/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-685-URL-AE875C4A049E"
      ],
      "supporting_locators": [
        "SOURCES",
        "S4",
        "- S4: pip Secure installs v26.2.1 — https://pip.pypa.io/en/stable/topics/secure-installs/"
      ],
      "scope": "SOURCES",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-685-URL-B533BC778486",
      "evidence_class": "RESEARCH",
      "title": "S5: pip install / Finding Packages —",
      "href": "https://pip.pypa.io/en/stable/cli/pip_install/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-685-URL-B533BC778486"
      ],
      "supporting_locators": [
        "SOURCES",
        "S5",
        "- S5: pip install / Finding Packages — https://pip.pypa.io/en/stable/cli/pip_install/"
      ],
      "scope": "SOURCES",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-685-URL-0869A4CCDB56",
      "evidence_class": "RESEARCH",
      "title": "S6: npm / Provenance limitations —",
      "href": "https://docs.npmjs.com/generating-provenance-statements/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-685-URL-0869A4CCDB56"
      ],
      "supporting_locators": [
        "SOURCES",
        "S6",
        "- S6: npm / Provenance limitations — https://docs.npmjs.com/generating-provenance-statements/"
      ],
      "scope": "SOURCES",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-685-URL-A7A8FFF2D41F",
      "evidence_class": "RESEARCH",
      "title": "S7: npm-audit v11 docs —",
      "href": "https://docs.npmjs.com/cli/v11/commands/npm-audit/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-685-URL-A7A8FFF2D41F"
      ],
      "supporting_locators": [
        "SOURCES",
        "S7",
        "- S7: npm-audit v11 docs — https://docs.npmjs.com/cli/v11/commands/npm-audit/"
      ],
      "scope": "SOURCES",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-685-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-685 監査済みresearch / canonical revision binding",
      "supports": [
        "USENIX Security 2025の研究は調査対象LLMのpackage hallucinationと同一名の再推薦を報告しています。測定率を現行全モデルへ適用しません。[S1]"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "checked_at": "2026-10-04",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "EA-685-FIRST-WORK-20261004"
      ],
      "supporting_locators": [
        "EA-685-FIRST-WORK-20261004",
        "content/staging/EA-685.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-685-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-685 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": "2026-10-04",
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0685-R8-3AD4C31F"
      ],
      "supporting_locators": [
        "WEBBODY-EA0685-R8-3AD4C31F",
        "content/staging/EA-685.md",
        "EA-685-FIRST-WORK-20261004"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "PUBLIC_CLAIM",
      "text": "AIが生成した依存パッケージ名は導入候補として扱います。存在確認、正常なhash、provenance、既知脆弱性scanのいずれも単独では安全性を保証しません。導入前の承認identityと、実際に取得するartifactのidentity・bytesを結び付けて確認する運用が必要です。この運用は設計上の提案であり、特定製品の防御率を実証したものではありません。"
    },
    {
      "heading": "ESTABLISHED",
      "text": "USENIX Security 2025の研究は調査対象LLMのpackage hallucinationと同一名の再推薦を報告しています。測定率を現行全モデルへ適用しません。[S1]\n\npip v26.2.1のhash-checkingは全要求・依存のpinとlocal hashを要求します。index提供hashと独立の承認hashは信頼基点が異なります。複数indexは単純な私有元優先ではなく、extra-index-urlにはdependency confusion警告があります。[S4,S5]\n\nnpm provenanceはbuild出所への検証可能な接続であり、悪意あるコードの不在を保証しません。npm auditの既知脆弱性照合とaudit signaturesの署名確認を区別します。ignore-scriptsでもexplicit npm run/test等の意図されたscriptまで無効にはなりません。[S6,S7]"
    },
    {
      "heading": "INFERENCE",
      "text": "導入許可はreviewed registry/name/version/publisher/source/digestへ限定し、取得bytesとの一致を確認します。未承認名、identity変更、bytes変更、承認期限切れは再reviewへ返します。allowlistの信頼基点が侵害されれば、この設計だけでは防げません。"
    },
    {
      "heading": "FAILURE_ENVELOPE",
      "text": "新しく登録された名前、既存publisher侵害、transitive依存、platform別artifact、確認後の再解決、例外導入、install後のimport/run/buildを別々に確認します。正しいhashでも元のコードが悪意ある場合は通過し得ます。script抑制、SBOM、署名、sandboxは個別の防御層であり相互の代替にはなりません。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "資料照合とoffline synthetic policy fixtureのみです。9ケースの期待結果が一致しました。registry、install、暗号署名、malware判定、LLM API、組織mirrorは試験していません。fixtureのALLOW_FIXTURE_ONLYをproductionの導入許可と扱いません。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "package manager version、registry/mirror、lockと全依存、artifact digest、承認owner/expiry、scriptとruntime制約、egress、例外監査、秘密情報を含むmanifestの送信先を確認します。"
    },
    {
      "heading": "UNKNOWN",
      "text": "現行全LLMの幻覚率、対象組織のtrust root、実resolver/署名挙動、mirror侵害、sandbox、SBOM漏れ、2026再評価preprintのraw再現は未確認です。"
    },
    {
      "heading": "STOP_CONDITION",
      "text": "存在・pin・hash・provenance・audit PASSを「安全」「slopsquatting防御済」「幻覚ゼロ」と読み替えないでください。staging candidateは未監査・未公開です。"
    },
    {
      "heading": "SOURCES",
      "text": "- S1: Spracklen et al., USENIX Security 2025, §5.3 — https://www.usenix.org/system/files/usenixsecurity25-spracklen.pdf\n- S3: Churilov, 2026 preprint v3（要旨確認のみ）— https://arxiv.org/abs/2605.17062v3\n- S4: pip Secure installs v26.2.1 — https://pip.pypa.io/en/stable/topics/secure-installs/\n- S5: pip install / Finding Packages — https://pip.pypa.io/en/stable/cli/pip_install/\n- S6: npm / Provenance limitations — https://docs.npmjs.com/generating-provenance-statements/\n- S7: npm-audit v11 docs — https://docs.npmjs.com/cli/v11/commands/npm-audit/\n- T1: EA-685_Evidence_Packet.md / fixtures/dependency_gate.py / results/EA-685.json（監査bundle内の再現資料）"
    }
  ],
  "human_url": "/tools/ea-685-coding-agent-dependency-hallucination-slopsquatting",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-685-coding-agent-dependency-hallucination-slopsquatting",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-685-coding-agent-dependency-hallucination-slopsquatting"
}