Package managers for software repositories based on a single programming language are very common. Examples include npm (JavaScript), and PyPI (Python). These tools encourage code reuse, making it trivial for developers to import external packages. Unfortunately, repositories' size and the ease with which packages can be published facilitates the practice of typosquatting: the uploading of a package with name similar to that of a highly popular package, typically with the aim of capturing some of the popular package's installs. Typosquatting has serious negative implications, resulting in developers importing malicious packages, or -- as we show -- code clones which do not incorporate recent security updates. In order to tackle this problem, we present SpellBound, a tool for identifying and reporting potentially erroneous imports to developers. SpellBound implements a novel typosquatting detection technique, based on an in-depth analysis of npm and PyPI. Our technique leverages a model of lexical similarity between names, and further incorporates the notion of package popularity. This approach flags cases where unknown/scarcely used packages would be installed in place of popular ones with similar names, before installation occurs. We evaluated SpellBound on both npm and PyPI, with encouraging results: SpellBound flags typosquatting cases while generating limited warnings (0.5% of total package installs), and low overhead (only 2.5% of package install time). Furthermore, SpellBound allowed us to confirm known cases of typosquatting and discover one high-profile, unknown case of typosquatting that resulted in a package takedown by the npm security team.

中文翻译：

---

SpellBound：防御包错别字

基于单一编程语言的软件存储库的包管理器非常常见。示例包括 npm (JavaScript) 和 PyPI (Python)。这些工具鼓励代码重用，使开发人员导入外部包变得微不足道。不幸的是，存储库的大小和可以发布包的容易程度促进了域名抢注的做法：上传名称与非常流行的包的名称相似的包，通常目的是捕获一些流行的包的安装。Typosquatting 会产生严重的负面影响，导致开发人员导入恶意包，或者——正如我们所展示的——代码克隆不包含最近的安全更新。为了解决这个问题，我们提出 SpellBound，一种用于识别并向开发人员报告潜在错误导入的工具。SpellBound 基于对 npm 和 PyPI 的深入分析，实现了一种新颖的域名抢注检测技术。我们的技术利用名称之间的词汇相似性模型，并进一步结合了包流行度的概念。这种方法标记了在安装之前安装未知/很少使用的软件包而不是具有相似名称的流行软件包的情况。我们在 npm 和 PyPI 上对 SpellBound 进行了评估，结果令人鼓舞：SpellBound 在生成有限警告（占总包安装量的 0.5%）和低开销（仅占包安装时间的 2.5%）的同时标记了域名抢注案例。此外，SpellBound 使我们能够确认已知的域名抢注案例并发现一个引人注目的，