Detect potential dependency confusion and typo squatting

[arewm]

Malicious packages which are uploaded with a similar name to other known-good packages (i.e. typosquatting) is a challenge for supply chain without a good solution that I am aware of. It would be interesting to see if malcontent could catch potential typosquatting attacks as these are often named similarly not not exactly the same. There are two potential modes of operation where I see these potentially malicious packages being introduced:

• A dependency disappears from the reference sources and a similar one appears in the new sources (dependency replacement)
• A new dependency is added which is named similar to an already used dependency (i.e. a change in a recursive dependency)

These packages may be versioned similarly but might not be.