Package confusion incidents--where a developer is misled into importing a package other than the intended one--are one of the most severe issues in supply chain security with significant security implications, especially when the wrong package has malicious functionality. While the prevalence of the issue is generally well-documented, little work has studied the range of mechanisms by which confusion in a package name could arise or be employed by an adversary. In our work, we present the first comprehensive categorization of the mechanisms used to induce confusion, and we show how this understanding can be used for detection. First, we use qualitative analysis to identify and rigorously define 13 categories of confusion mechanisms based on a dataset of 1200+ documented attacks. Results show that, while package confusion is thought to mostly exploit typing errors, in practice attackers use a variety of mechanisms, many of which work at semantic, rather than syntactic, level. Equipped with our categorization, we then define detectors for the discovered attack categories, and we evaluate them on the entire npm package set. Evaluation of a sample, performed through an online survey, identifies a subset of highly effective detection rules which (i) return high-quality matches (77% matches marked as potentially or highly confusing, and 18% highly confusing) and (ii) generate low warning overhead (1 warning per 100M+ package pairs). Comparison with state-of-the-art reveals that the large majority of such pairs are not flagged by existing tools. Thus, our work has the potential to concretely improve the identification of confusable package names in the wild.

Vertical take-off and landing (VTOL) aircraft leverage the performance and efficiency of fixed-wing aircraft with the operational flexibility of rotary-wing aircraft. However, their complex dynamics and the inherent multi-mode of operation often make sufficiently robust controller design difficult, time consuming, and expensive. Transitioning between flight modes (e.g. vertical takeoff to cruise or cruise to landing) risks instability, oscillations, and high-G maneuvers. These challenges have been traditionally solved by relying on multi-modal PID design patterns and gain scheduling, necessitating the development of a different controller for each flight mode. Modern VTOL flight controller methods (e.g. Model Predictive Control) are often heavily model dependent and lack robustness to large uncertainties in the aircraft dynamic model. Such dependency eliminates any opportunity for flight controller to be transferable between different aircraft platforms without labor intensive practices. This paper presents simulation results of a deep learning based model-agnostic quad mode VTOL controller that is trained and optimized with the Proximal Policy Optimization (PPO) algorithm in simulation. Our controller is fully policy based rather than dynamic model dependent (e.g. LQR, H2, MPC, etc.) and thus is fully transferable between models without any retraining. Flight controller performance and robustness against perturbation is shown through a rigorous test suite that leverages data generated from real flight tests and the Dryden wind turbulence model.