Unicode同形字与包名混淆防护（Confusables-白名单-正规化）最佳实践

实现示例const confusables = new Map<string, string>([ ['а','a'],['е','e'],['і','i'],['ο','o'],['р','p'],['ѕ','s'],['ν','v'] ]) function normalizeName(n: string): string { return n.normalize('NFKC') } function hasNonAscii(n: string): boolean { return /[^\x00-\x7F]/.test(n) } function replaceConfusables(n: string): string { let out = ''; for (const ch of n) out += confusables.get(ch) || ch; return out } function suspicious(n: string): boolean { const norm = normalizeName(n) if (/^@/.test(norm)) return false if (hasNonAscii(norm)) return true const rep = replaceConfusables(norm) return rep !== norm } function allowName(n: string, allow: Set<string>): boolean { if (allow.has(n)) return true return !suspicious(n) } 审计与CI门禁对新包名执行检测；命中混淆阻断并输出近似名称建议。白名单变更需审批与到期；产线默认拒绝未审批项。