依赖命名混淆与冒充防护（Typosquatting-白名单）最佳实践

核心要点维护核心包白名单与受信作用域；对新名称执行距离与正则检测。阈值策略：距离过近或包含可疑模式即阻断；支持人工复核通道。实现示例const allowNames = new Set<string>(['react','vue','lodash','express','@example/core']) function normalize(n: string): string { return n.toLowerCase().replace(/[-_.]+/g, '') } function levenshtein(a: string, b: string): number { const m = Array.from({ length: a.length + 1 }, (_, i) => i) for (let j = 1; j <= b.length; j++) { let prev = m[0] m[0] = j for (let i = 1; i <= a.length; i++) { const tmp = m[i] m[i] = Math.min( m[i] + 1, m[i - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1) ) prev = tmp } } return m[a.length] } function suspicious(name: string, threshold: number): boolean { const n = normalize(name) for (const a of allowNames) { if (levenshtein(n, normalize(a)) <= threshold) return true } if (/^(?:re|ve|lo|ex)[a-z]{2,}\d+$/.test(n)) return true return false } function allowInstall(name: string, threshold = 2): boolean { if (allowNames.has(name)) return true return !suspicious(name, threshold) } 审计与CI门禁对新引入依赖执行检测；命中阻断并输出相似目标与证据。对可疑项启用人工审批与到期例外；产线默认拒绝未审批项。