Detect potential dependency confusion and typo squatting

Malicious packages which are uploaded with a similar name to other known-good packages (i.e. typosquatting) is a challenge for supply chain without a good solution that I am aware of. It would be interesting to see if malcontent could catch potential typosquatting attacks as these are often named similarly not not exactly the same. There are two potential modes of operation where I see these potentially malicious packages being introduced:

• A dependency disappears from the reference sources and a similar one appears in the new sources (dependency replacement)
• A new dependency is added which is named similar to an already used dependency (i.e. a change in a recursive dependency)

These packages may be versioned similarly but might not be.

The issue names no files, tests, package manager, or implementation entry point. Start by locating malcontent's existing dependency and reference-source analysis, then determine how the two described replacement and newly added dependency cases could be evaluated. Done means potential typosquatting is reported for similar names, including cases where versions are similar or differ.