typosquatting 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc18d0104e41766e5b0b8603d786cde1ff74f7b65360509a8d880732b1d5f6ca
-  data.tar.gz: fb48d984d14196d0ccdb2765ee14d986f614d9d1285c329fe6b57d8fe1cb35a6
+  metadata.gz: 1b77954d544fc39b144352e1dfa75ab18f52701b1c8e9d7b49f940158c10f38f
+  data.tar.gz: 3dec0264d6573615efebeb2a6d21e42a1c610e36a5e62449f35d5cee653bc748
 SHA512:
-  metadata.gz: 0b9103d71382bbdfb8af88843a4c73d0abf99a65da6b494027c21d3327eb31f8261545c95514dd0bd4b35b7f681c54d70e4a1abb819d9ac020fcceebd96784d5
-  data.tar.gz: 122e21bf9b46b6379ea2d925998797161020500e56d440f916a43f995faf4865bad5d60cd5077e2e2d33ebc6cd4aa9046af9e419ac02a39729a156fb016376cf
+  metadata.gz: bd100e0d02cda3102f1a65c971a9466deb707f3fc54dc277e188a55d0b8bc91990088469c766f3fa1105950e289152295f0980d392070f8b6eac29f985787b25
+  data.tar.gz: cd6b58996822828dc412f8c88baddc792ff80e8ae3b69247f0b1e9481738c2718e630495e7ec4d1b9c8023eaf497c8aafe7f1b4b5b6f3ce866e66d4fbf928a06

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## [Unreleased]
 
+## [0.5.0] - 2026-01-04
+
+- Add bulk lookup for SBOM checking to reduce API calls
+- Test against Ruby 3.4 and 4.0 in CI
+
 ## [0.4.0] - 2026-01-02
 
 - Skip intra-namespace typosquats for scoped packages (npm, composer, golang) since namespace owners control all packages under their namespace

data/lib/typosquatting/lookup.rb

@@ -47,6 +47,39 @@ module Typosquatting
       package_names.map { |name| results.find { |n, _| n == name }&.last }
     end
 
+    def bulk_lookup(package_names)
+      return [] if package_names.empty?
+
+      purls = package_names.map { |name| build_purl(name).to_s }
+
+      all_packages = []
+      purls.each_slice(100) do |batch|
+        response = post_json("/packages/bulk_lookup", { purls: batch })
+        all_packages.concat(response || [])
+      end
+
+      packages_by_purl = {}
+      all_packages.each do |pkg|
+        purl = pkg["purl"]
+        next unless purl
+
+        packages_by_purl[purl] ||= []
+        packages_by_purl[purl] << pkg
+      end
+
+      package_names.map do |name|
+        purl = build_purl(name).to_s
+        packages = packages_by_purl[purl] || []
+
+        Result.new(
+          name: name,
+          purl: purl,
+          packages: packages,
+          ecosystem: ecosystem.purl_type
+        )
+      end
+    end
+
     def registries
       response = fetch("/registries?ecosystem=#{URI.encode_www_form_component(ecosystem.purl_type)}")
       response&.map { |r| Registry.new(r) } || []
@@ -246,6 +279,32 @@ module Typosquatting
 
       raise
     end
+
+    def post_json(path, body)
+      uri = URI("#{API_BASE}#{path}")
+      request = Net::HTTP::Post.new(uri)
+      request["User-Agent"] = USER_AGENT
+      request["Accept"] = "application/json"
+      request["Content-Type"] = "application/json"
+      request.body = JSON.generate(body)
+
+      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
+        http.request(request)
+      end
+
+      case response
+      when Net::HTTPSuccess
+        JSON.parse(response.body)
+      when Net::HTTPNotFound
+        []
+      else
+        raise APIError, "API request failed: #{response.code} #{response.message}"
+      end
+    rescue StandardError => e
+      raise APIError, "API request failed: #{e.message}" unless e.is_a?(APIError)
+
+      raise
+    end
   end
 
   class APIError < StandardError; end

data/lib/typosquatting/sbom.rb

@@ -79,20 +79,23 @@ module Typosquatting
       lookup = Lookup.new(ecosystem: ecosystem)
 
       variants = generator.generate(package_name)
-      suspicions = []
+      return [] if variants.empty?
 
-      variants.each do |variant|
-        result = lookup.check(variant.name)
-        next unless result.exists?
+      variant_names = variants.map(&:name)
+      results = lookup.bulk_lookup(variant_names)
 
-        suspicions << Suspicion.new(
+      results_by_name = results.to_h { |r| [r.name, r] }
+
+      variants.filter_map do |variant|
+        result = results_by_name[variant.name]
+        next unless result&.exists?
+
+        Suspicion.new(
           name: variant.name,
           algorithm: variant.algorithm,
           registries: result.registries
         )
       end
-
-      suspicions
     end
   end
 end

data/lib/typosquatting/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Typosquatting
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: typosquatting
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Andrew Nesbitt