Typosquatting in package repositories [LWN.net]

Typosquatting in package repositories

Posted Jul 26, 2016 9:42 UTC (Tue) by HenrikH (subscriber, #31152)
Parent article: Typosquatting in package repositories

I first step should be to implement a soundex (https://en.wikipedia.org/wiki/Soundex) filter on the contribution page so that two packages with same sounding name could not be uploaded. Of course this would only work for English sounding packages and is no real long term solution that a fully manual vetting process would be but at least it would be a quick fix for the most obvious problems.

to post comments

Typosquatting in package repositories

Posted Jul 26, 2016 21:50 UTC (Tue) by jwilk (subscriber, #63328) [Link] (1 responses)

There are more than 85000 packages on PyPI, but only 6734 different Soundex codes.

Typosquatting in package repositories

Posted Jul 27, 2016 14:28 UTC (Wed) by HenrikH (subscriber, #31152) [Link]

Could still be used as a way to ignore new automatic contributions, i.e if something like soundex warns then they have to get a manual ok from "some one" before the new project can be added.