Unicode同形字与包名混淆防护（Confusables-白名单-正规化）最佳实践

实现示例const confusables = new Map<string, string>([

['а','a'],['е','e'],['і','i'],['ο','o'],['р','p'],['ѕ','s'],['ν','v']

])

function normalizeName(n: string): string { return n.normalize('NFKC') }

function hasNonAscii(n: string): boolean { return /[^\x00-\x7F]/.test(n) }

function replaceConfusables(n: string): string { let out = ''; for (const ch of n) out += confusables.get(ch) || ch; return out }

function suspicious(n: string): boolean {

const norm = normalizeName(n)

if (/^@/.test(norm)) return false

if (hasNonAscii(norm)) return true

const rep = replaceConfusables(norm)

return rep !== norm

}

function allowName(n: string, allow: Set<string>): boolean {

if (allow.has(n)) return true

return !suspicious(n)

}

审计与CI门禁对新包名执行检测；命中混淆阻断并输出近似名称建议。白名单变更需审批与到期；产线默认拒绝未审批项。