一句话：提出 ConfuGuard，利用包元数据区分良性包，将包混淆攻击检测误报率从80%降至28%，并扩展至7个包注册表。
包混淆攻击（如域名抢注式 typosquatting）通过名称在语法或语义上模仿合法包，诱使工程师安装恶意软件，威胁软件供应链。已有防御主要针对 NPM、PyPI 和 RubyGems，仍存在误报率高、难以泛化到更多生态以及缺乏真实部署经验等问题。本文提出 ConfuGuard，首先对已有包混淆数据中的良性信号进行首次实证分析，揭示其威胁模式、工程实践与可度量属性；进而利用包元数据区分良性包，将检测支持从3个扩展到7个软件包注册表。评估表明，该方法将误报率从80%显著降至28%，代价是平均增加14秒延迟以通过元数据分析过滤良性包。ConfuGuard 已在工业合作方的生产环境中使用，其分析师已确认由 ConfuGuard 检测出的630个真实攻击。
Package confusion attacks, such as typosquatting, threaten software supply chains. Attackers make packages with names that syntactically or semantically resemble legitimate ones, tricking engineers into installing malware. While prior work has developed defenses against package confusions in some software package registries, notably NPM, PyPI, and RubyGems, gaps remain: high false-positive rates, generalization to more software package ecosystems, and insights from real-world deployment. In this work, we introduce ConfuGuard, a state-of-the-art detector for package confusion threats. We begin by presenting the first empirical analysis of benign signals derived from prior package confusion data, uncovering their threat patterns, engineering practices, and measurable attributes. Advancing existing detectors, we leverage package metadata to distinguish benign packages, and extend support from three up to seven software package registries. Our approach significantly reduces false positive rates (from 80% to 28%), at the cost of an additional 14s average latency to filter out benign packages by analyzing the package metadata. ConfuGuard is used in production at our industry partner, whose analysts have already confirmed 630 real attacks detected by ConfuGuard.
@inproceedings{paperbot11504,
title = {ConfuGuard: Using Metadata to Detect Active and Stealthy Package Confusion Attacks Accurately and at Scale},
author = {Wenxin Jiang and Berk Çakar and Mikola Lysenko and James C Davis},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773229}
}