SpellBound：防范软件包类型错误
SpellBound: Defending Against Package Typosquatting
摘要：
基于单一程序设计语言的软件存储库的包管理器非常常见。例子包括npm（JavaScript）和PyPI（Python）。这些工具鼓励代码重用，使开发人员导入外部包变得微不足道。不幸的是，仓库的大小和发布软件包的容易程度促进了排印的实践：上传一个与一个非常流行的软件包名称相似的软件包，通常目的是捕获一些流行软件包的安装。错别字有严重的负面影响，导致开发人员导入恶意软件包，或者-正如我们所展示的-不包含最新安全更新的代码克隆。为了解决这个问题，我们提出了SpellBound，一个工具，用于识别和报告潜在的错误导入开发人员。SpellBound基于对npm和PyPI的深入分析，实现了一种新的排版检测技术。我们的技术利用名称之间的词汇相似性模型，并进一步结合了包流行度的概念。这种方法会在安装之前标记未知/很少使用的软件包将被安装在具有相似名称的流行软件包的位置的情况。我们在npm和PyPI上对SpellBound进行了评估，结果令人鼓舞：SpellBound在生成有限警告（占软件包安装总量的0.5%）的同时标记了typosquatting案例，并且开销很低（仅占软件包安装时间的2.5%）。此外，SpellBound允许我们确认已知的typosquatting案例，并发现一个备受瞩目的未知typosquatting案例，导致npm安全团队删除了一个包。
英文摘要：
Package managers for software repositories based on a single programming language are very common. Examples include npm (JavaScript), and PyPI (Python). These tools encourage code reuse, making it trivial for developers to import external packages. Unfortunately, repositories' size and the ease with which packages can be published facilitates the practice of typosquatting: the uploading of a package with name similar to that of a highly popular package, typically with the aim of capturing some of the popular package's installs. Typosquatting has serious negative implications, resulting in developers importing malicious packages, or -- as we show -- code clones which do not incorporate recent security updates. In order to tackle this problem, we present SpellBound, a tool for identifying and reporting potentially erroneous imports to developers. SpellBound implements a novel typosquatting detection technique, based on an in-depth analysis of npm and PyPI. Our technique leverages a model of lexical similarity between names, and further incorporates the notion of package popularity. This approach flags cases where unknown/scarcely used packages would be installed in place of popular ones with similar names, before installation occurs. We evaluated SpellBound on both npm and PyPI, with encouraging results: SpellBound flags typosquatting cases while generating limited warnings (0.5% of total package installs), and low overhead (only 2.5% of package install time). Furthermore, SpellBound allowed us to confirm known cases of typosquatting and discover one high-profile, unknown case of typosquatting that resulted in a package takedown by the npm security team.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
