@deepv-code/safe-npm 0.1.0 → 0.1.2

package/dist/cli/check.d.ts

@@ -1,5 +1,6 @@
 export interface CheckOptions {
     isForce?: boolean;
     install?: boolean;
+    isGlobal?: boolean;
 }
 export declare function checkPackages(packages: string[], options?: CheckOptions): Promise<boolean>;

package/dist/cli/check.js

@@ -114,7 +114,11 @@ export async function checkPackages(packages, options = {}) {
             const shouldInstall = await promptInstallCorrect(result.suggestedPackage);
             if (shouldInstall) {
                 console.log(chalk.green(`\n${t('installingCorrect')}: ${result.suggestedPackage}...`));
-                await runNpm(['install', result.suggestedPackage]);
+                const installArgs = ['install', result.suggestedPackage];
+                if (options.isGlobal) {
+                    installArgs.push('-g');
+                }
+                await runNpm(installArgs);
                 // Return false to stop the original (malicious) installation logic
                 // But we essentially succeeded in the user's intent.
                 // However, to keep flow clean, we exit the process here or return false to block original.

package/dist/index.js

@@ -62,6 +62,7 @@ async function main() {
         const safe = await checkPackages(parsed.packages, {
             isForce: parsed.isForce,
             install: true,
+            isGlobal: parsed.isGlobal,
         });
         if (!safe) {
             process.exit(1);

package/dist/scanner/index.js

@@ -137,8 +137,12 @@ export async function scanPackage(packageName, options = {}, onProgress) {
         if (issue.severity === 'fatal') {
             riskLevel = 'fatal';
             canBypass = false;
-            // Try to extract suggestion from typosquat details
-            if (issue.type === 'typosquat' && issue.details?.includes('"')) {
+            // Use explicit suggestion if available
+            if (issue.suggestion) {
+                suggestedPackage = issue.suggestion;
+            }
+            // Fallback: Try to extract from details (legacy/fallback)
+            else if (issue.type === 'typosquat' && issue.details?.includes('"')) {
                 const match = issue.details.match(/"([^"]+)"/);
                 if (match)
                     suggestedPackage = match[1];

package/dist/scanner/types.d.ts

@@ -18,6 +18,7 @@ export interface ScanIssue {
     severity: RiskLevel;
     message: string;
     details?: string;
+    suggestion?: string;
 }
 export interface ScanOptions {
     offline?: boolean;

package/dist/scanner/typosquatting.js

@@ -88,6 +88,7 @@ export async function scanTyposquatting(packageName) {
                 severity: 'fatal',
                 message: t('typosquatDetected'),
                 details: `Similar to popular package "${popular}" (distance: ${distance})`,
+                suggestion: popular,
             });
             break;
         }
@@ -97,6 +98,7 @@ export async function scanTyposquatting(packageName) {
                 severity: 'fatal',
                 message: t('typosquatDetected'),
                 details: `Suspicious similarity to "${popular}"`,
+                suggestion: popular,
             });
             break;
         }
@@ -116,6 +118,7 @@ export async function scanTyposquatting(packageName) {
                         severity: 'fatal',
                         message: t('typosquatDetected'),
                         details: `Scope Hijacking Detected: This package "${packageName}" mimics the official package "${popular}". Verify the scope carefully!`,
+                        suggestion: popular,
                     });
                     break;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepv-code/safe-npm",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "A security-focused npm wrapper that scans packages before installation",
   "main": "dist/index.js",
   "type": "module",
@@ -11,7 +11,11 @@
     "start": "node dist/index.js",
     "build": "tsc",
     "dev": "tsc -w",
-    "test": "vitest"
+    "test": "vitest",
+    "prepublishOnly": "npm run build && npm run test",
+    "patch": "npm version patch && npm publish",
+    "minor": "npm version minor && npm publish",
+    "major": "npm version major && npm publish"
   },
   "keywords": [
     "npm",