Marketplaces stop lookalikes with a mix of reserved names, similarity checks, trademark rules and fork naming rules, backed by takedown when a rule is broken and by user reports. No single check catches everything, so reviewers combine automated name matching with human judgement.
What published policies say
The Visual Studio Marketplace documentation says it stops extension authors from stealing the names of official publishers, such as Microsoft or RedHat, and of popular extensions. Verified publishers add a second signal, since the blue check shows proven domain ownership.
Mozilla's add-on policies cover naming in several ways. Add-ons using Firefox in the name must follow the pattern of the add-on name followed by "for Firefox". If an add-on is a fork of another, its name must clearly distinguish it from the original and it must provide a significant difference in functionality or code. Add-ons whose only purpose is promoting or launching an outside site, app or add-on are not permitted.
WordPress.org's guideline 17 says plugins must respect trademarks, copyrights and project names.
The attack in plain terms
An attacker publishes a plugin with a name, icon and description close to a popular one, then relies on search results and hurried users. Once installed, a lookalike can do whatever its permissions allow. Naming defenses reduce that, but they work best alongside permission limits.
Controls to add
| Control | What it catches |
|---|---|
| Reserved names for known brands | Direct impersonation of a publisher |
| Edit distance and homoglyph checks | Near copies with swapped or look alike characters |
| Icon and description similarity | Copycats that change only the title |
| Fork naming rule | Clones passing as the original |
| Verified publisher shown next to name | Helps users choose the real one |
| Report button with fast response | Catches what automation misses |
Steps for your own marketplace
- Build a reserved list from publishers who ask, and from your own top plugins.
- Compare each new name against existing names using normalization, so uppercase, spacing and look alike characters do not hide a match.
- Send near matches to a human, with the matched plugin shown side by side.
- Require forks to say what they fork and what changed.
- Show the publisher identity and permission summary beside the plugin name in search results.
- Track installs and ratings velocity. A new plugin with a sudden burst may be gaming the ranking, which the Visual Studio Marketplace describes monitoring as unusual usage detection.
- Make reporting simple and publish how fast you respond.
Do not forget the package name
Plugins often sit on a package registry too, where typosquatting works the same way. If your plugins install from a public registry, check that the names you rely on are claimed and consistent, and ask partners to claim their own.
Quick check
Are trademark rules enough to stop lookalikes?
No. They help against brand abuse but a lookalike can use a descriptive name no one owns. Similarity checks and permission limits are still needed.
Should forks be banned?
No. Forks are legitimate. The Mozilla rule is a good model: require a distinct name and a meaningful difference.
Safeguard helps users of plugin ecosystems on the dependency side with SBOM and dependency scanning and with policies that can flag unexpected packages. The free scan is a quick way to see what a build pulls in.
Sources
- Extension runtime security, Visual Studio Code
- Add-on Policies, Firefox Extension Workshop
- Detailed Plugin Guidelines, WordPress Plugin Handbook
Last reviewed: 19 October 2026.
