typosquatting 0.4.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc18d0104e41766e5b0b8603d786cde1ff74f7b65360509a8d880732b1d5f6ca
-  data.tar.gz: fb48d984d14196d0ccdb2765ee14d986f614d9d1285c329fe6b57d8fe1cb35a6
+  metadata.gz: f791ab61b6b1a907c25e8ecba6f3e6a2f341e07f5232125297405093e4841cef
+  data.tar.gz: 8cea179d8c952ca8b93fb42b76d060f02ec312500b1f4a2ffd2e372e2535385b
 SHA512:
-  metadata.gz: 0b9103d71382bbdfb8af88843a4c73d0abf99a65da6b494027c21d3327eb31f8261545c95514dd0bd4b35b7f681c54d70e4a1abb819d9ac020fcceebd96784d5
-  data.tar.gz: 122e21bf9b46b6379ea2d925998797161020500e56d440f916a43f995faf4865bad5d60cd5077e2e2d33ebc6cd4aa9046af9e419ac02a39729a156fb016376cf
+  metadata.gz: cdb27c59163382c8615a3e5783c519e578271be0d52a16beddbf8458a8cf1b62e582e8eec297f8d1cf28c67840bac27e1533cb018b59ed8df3e2af46dca1c80a
+  data.tar.gz: 5298442b1f8cafc97fa7c20b321c2cffd6d3a638a5e04b9749047c5341927259eb325e3199d056902e4741b34e51d0e25f431973e4c90841874e19b5d8ce8936

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 ## [Unreleased]
 
+## [0.5.1] - 2026-01-04
+
+- Filter duplicate packages in SBOM checking to avoid redundant results and API calls
+
+## [0.5.0] - 2026-01-04
+
+- Add bulk lookup for SBOM checking to reduce API calls
+- Test against Ruby 3.4 and 4.0 in CI
+
 ## [0.4.0] - 2026-01-02
 
 - Skip intra-namespace typosquats for scoped packages (npm, composer, golang) since namespace owners control all packages under their namespace

data/lib/typosquatting/lookup.rb

@@ -47,6 +47,39 @@ module Typosquatting
       package_names.map { |name| results.find { |n, _| n == name }&.last }
     end
 
+    def bulk_lookup(package_names)
+      return [] if package_names.empty?
+
+      purls = package_names.map { |name| build_purl(name).to_s }
+
+      all_packages = []
+      purls.each_slice(100) do |batch|
+        response = post_json("/packages/bulk_lookup", { purls: batch })
+        all_packages.concat(response || [])
+      end
+
+      packages_by_purl = {}
+      all_packages.each do |pkg|
+        purl = pkg["purl"]
+        next unless purl
+
+        packages_by_purl[purl] ||= []
+        packages_by_purl[purl] << pkg
+      end
+
+      package_names.map do |name|
+        purl = build_purl(name).to_s
+        packages = packages_by_purl[purl] || []
+
+        Result.new(
+          name: name,
+          purl: purl,
+          packages: packages,
+          ecosystem: ecosystem.purl_type
+        )
+      end
+    end
+
     def registries
       response = fetch("/registries?ecosystem=#{URI.encode_www_form_component(ecosystem.purl_type)}")
       response&.map { |r| Registry.new(r) } || []
@@ -246,6 +279,32 @@ module Typosquatting
 
       raise
     end
+
+    def post_json(path, body)
+      uri = URI("#{API_BASE}#{path}")
+      request = Net::HTTP::Post.new(uri)
+      request["User-Agent"] = USER_AGENT
+      request["Accept"] = "application/json"
+      request["Content-Type"] = "application/json"
+      request.body = JSON.generate(body)
+
+      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
+        http.request(request)
+      end
+
+      case response
+      when Net::HTTPSuccess
+        JSON.parse(response.body)
+      when Net::HTTPNotFound
+        []
+      else
+        raise APIError, "API request failed: #{response.code} #{response.message}"
+      end
+    rescue StandardError => e
+      raise APIError, "API request failed: #{e.message}" unless e.is_a?(APIError)
+
+      raise
+    end
   end
 
   class APIError < StandardError; end

data/lib/typosquatting/sbom.rb

@@ -12,8 +12,28 @@ module Typosquatting
     end
 
     def check
+      unique_packages = extract_unique_packages
       results = []
 
+      unique_packages.each do |key, pkg_info|
+        suspicions = find_typosquat_matches(pkg_info[:name], pkg_info[:ecosystem])
+        next if suspicions.empty?
+
+        results << SBOMResult.new(
+          name: pkg_info[:name],
+          version: nil,
+          ecosystem: pkg_info[:ecosystem_type],
+          purl: pkg_info[:purl],
+          suspicions: suspicions
+        )
+      end
+
+      results
+    end
+
+    def extract_unique_packages
+      packages = {}
+
       sbom.packages.each do |pkg|
         purl_string = extract_purl(pkg)
         next unless purl_string
@@ -31,19 +51,17 @@ module Typosquatting
         end
 
         package_name = purl.namespace ? "#{purl.namespace}/#{purl.name}" : purl.name
-        suspicions = find_typosquat_matches(package_name, ecosystem)
-        next if suspicions.empty?
+        key = "#{purl.type}:#{package_name}"
 
-        results << SBOMResult.new(
+        packages[key] ||= {
           name: package_name,
-          version: purl.version,
-          ecosystem: purl.type,
-          purl: purl_string,
-          suspicions: suspicions
-        )
+          ecosystem: ecosystem,
+          ecosystem_type: purl.type,
+          purl: purl_string
+        }
       end
 
-      results
+      packages
     end
 
     SBOMResult = Struct.new(:name, :version, :ecosystem, :purl, :suspicions, keyword_init: true) do
@@ -79,20 +97,23 @@ module Typosquatting
       lookup = Lookup.new(ecosystem: ecosystem)
 
       variants = generator.generate(package_name)
-      suspicions = []
+      return [] if variants.empty?
+
+      variant_names = variants.map(&:name)
+      results = lookup.bulk_lookup(variant_names)
 
-      variants.each do |variant|
-        result = lookup.check(variant.name)
-        next unless result.exists?
+      results_by_name = results.to_h { |r| [r.name, r] }
 
-        suspicions << Suspicion.new(
+      variants.filter_map do |variant|
+        result = results_by_name[variant.name]
+        next unless result&.exists?
+
+        Suspicion.new(
           name: variant.name,
           algorithm: variant.algorithm,
           registries: result.registries
         )
       end
-
-      suspicions
     end
   end
 end

data/lib/typosquatting/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Typosquatting
-  VERSION = "0.4.0"
+  VERSION = "0.5.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: typosquatting
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Andrew Nesbitt