依赖混淆与Dependency Confusion防护（内部作用域-解析顺序-阻断）最佳实践

核心要点内部 `@scope` 映射到私库且禁止公共回退；解析顺序严格固定。解析结果需与策略一致；异常阻断并审计。实现示例type ScopeMap = { [scope: string]: string } const privateOrigins = new Set<string>(['https://registry.example.com']) const publicOrigins = new Set<string>(['https://registry.npmjs.org']) function origin(u: string): string | null { try { const url = new URL(u); return url.origin } catch { return null } } function decideRegistry(name: string, map: ScopeMap): string | null { if (name.startsWith('@')) { const s = name.split('/')[0] const reg = map[s] return reg || null } return Array.from(publicOrigins)[0] } function enforce(name: string, resolved: string, map: ScopeMap): { ok: boolean; errors: string[] } { const errors: string[] = [] const o = origin(resolved) const expect = decideRegistry(name, map) if (!o || !expect) errors.push('resolve') else { const eo = origin(expect) if (!eo) errors.push('expect') else { const isPrivate = privateOrigins.has(eo) if (name.startsWith('@') && !isPrivate) errors.push('scope-private') if (eo !== o) errors.push('mismatch') } } return { ok: errors.length === 0, errors } } 审计与CI门禁审计记录包含包名、期望与实际来源；不一致阻断并输出证据。禁止内部作用域解析到公共注册表；变更需审批与复核。