Projects / 07
Typosentinel
An early exploration of typosquatting-style risk in software supply chains, where a dependency name close to a legitimate one is installed by mistake.
Overview
Typosentinel is the name we use for an area KOR IT is exploring: typosquatting-style risk in software supply chains, where a package whose name closely resembles a legitimate dependency is installed by mistake.
The problem
Package ecosystems resolve dependencies by name. A name that differs from a legitimate one by a character, a separator or a plausible misspelling can be published by anyone, and it will be installed whenever someone types or copies the wrong string.
The failure is quiet. Installation succeeds, the build proceeds, and the mistake surfaces only if something later looks at what was actually resolved.
Architecture
No architecture is published for this project.
Security model
The general assumption in this problem space is that a package registry is an open publication surface and that package names carry no inherent trust. No project-specific trust model is published yet.
Current status
Early exploration. There is nothing to describe publicly beyond the problem space above.
Limitations
The main limitation is that this entry documents an interest rather than a result. No claims are made about detection, coverage or effectiveness because no such work has been published.
Roadmap
- Define the problem scope precisely enough to be written down.
- Publish a technical description once the work is ready to be described publicly.
- Expand this entry at that point.
Detail
Topics
- software supply chain
- typosquatting
- dependencies
- early research