microsoft / microsoft/OSSGadget
Improvements to oss-find-squats
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- C#
- Stars
- 371
- Forks
- 58
- PR merge metrics
- No merged PRs in 30d
Description
Let's use this issue to discuss potential improvements to oss-find-squats (typosquatting detection).
Some thoughts:
Reduce False Positives
- Metadata Diff: We could take some part of the metadata of the target and suspicious package (description, README.md content, etc.) and calculate similarity (levenshtein, intersection of unique words, etc.), and use that result when calculating the final similarity score.
- Empty Metadata: If the description, source repo, or other relevant data is missing, then it's more likely that the package is a genuine typosquat.
- Low Usage: If the package has minimal downloaded (< 1% of those of the target package), then it's more likely to be a typosquat.
- Content Diff: Download both packages and compare the contents to see if there is an overlap.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the oss-find-squats tool and review how it currently calculates package similarity. The issue lists metadata, empty metadata, low usage, and content comparison as possible improvements, so first determine which proposal is intended; done would require an agreed approach and implementation for a defined false-positive reduction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100