devcompass 2.7.0 → 2.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devcompass",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Dependency health checker with ecosystem intelligence, real-time GitHub issue tracking for 500+ popular npm packages, parallel processing, supply chain security analysis, and advanced license risk detection.",
   "main": "src/index.js",
   "bin": {
@@ -76,4 +76,4 @@
     "url": "https://github.com/AjayBThorat-20/devcompass/issues"
   },
   "homepage": "https://github.com/AjayBThorat-20/devcompass#readme"
-}
+}

package/src/analyzers/supply-chain.js

@@ -54,45 +54,51 @@ function levenshteinDistance(str1, str2) {
 /**
  * Detect typosquatting attempts
  */
-function detectTyposquatting(packageName, database) {
+function detectTyposquatting(packageName, packageVersion, maliciousDb) {
   const warnings = [];
   
+  // Whitelist of legitimate popular packages that might have similar names
+  // These should NEVER be flagged as typosquatting
+  const LEGITIMATE_PACKAGES = [
+    'chalk', 'chai', 'ora', 'yargs', 'meow', 'execa', 'globby', 'del', 'make-dir',
+    'p-map', 'p-limit', 'p-queue', 'got', 'ky', 'node-fetch', 'cross-fetch',
+    'uuid', 'nanoid', 'cuid', 'luxon', 'date-fns', 'ms', 'bytes', 'filesize',
+    'fast-glob', 'chokidar', 'picomatch', 'micromatch', 'anymatch',
+    'semver', 'commander', 'yargs', 'inquirer', 'prompts', 'enquirer',
+    'debug', 'pino', 'winston', 'bunyan', 'signale'
+  ];
+  
+  // Skip whitelist packages
+  if (LEGITIMATE_PACKAGES.includes(packageName)) {
+    return warnings;
+  }
+  
   // Check against known typosquat patterns
-  for (const [official, typos] of Object.entries(database.typosquat_patterns)) {
-    if (typos.includes(packageName.toLowerCase())) {
+  // typosquat_patterns is an object: { "express": ["epress", "expres"], ... }
+  const patterns = maliciousDb.typosquat_patterns || {};
+  
+  for (const officialName of Object.keys(patterns)) {
+    // Skip if the official package is also whitelisted (both are legitimate)
+    // This prevents false positives like "chalk" vs "chai"
+    if (LEGITIMATE_PACKAGES.includes(officialName)) {
+      continue;
+    }
+    
+    const distance = levenshteinDistance(packageName, officialName);
+    
+    // Flag if 1-2 character difference (typosquatting likely)
+    if (distance > 0 && distance <= 2 && packageName !== officialName) {
       warnings.push({
-        package: packageName,
+        package: `${packageName}@${packageVersion}`,
         type: 'typosquatting',
-        severity: 'high',
-        official: official,
-        message: `Potential typosquatting: "${packageName}" is similar to official package "${official}"`,
-        recommendation: `Remove ${packageName} and install ${official} instead`
+        severity: distance === 1 ? 'high' : 'medium',
+        message: `Similar to: ${officialName} (official package)`,
+        recommendation: `Verify if you meant to install ${officialName}`,
+        official: officialName
       });
     }
   }
   
-  // Check Levenshtein distance against popular packages
-  const popularPackages = Object.keys(database.typosquat_patterns);
-  for (const popular of popularPackages) {
-    const distance = levenshteinDistance(packageName.toLowerCase(), popular.toLowerCase());
-    
-    // If distance is 1-2 characters and not already flagged
-    if (distance > 0 && distance <= 2 && packageName !== popular) {
-      const alreadyFlagged = warnings.some(w => w.package === packageName);
-      
-      if (!alreadyFlagged) {
-        warnings.push({
-          package: packageName,
-          type: 'typosquatting_suspected',
-          severity: 'medium',
-          official: popular,
-          message: `Possible typosquatting: "${packageName}" is very similar to "${popular}"`,
-          recommendation: `Verify if you meant to install ${popular}`
-        });
-      }
-    }
-  }
-  
   return warnings;
 }
 
@@ -181,7 +187,7 @@ async function analyzeSupplyChain(projectPath, dependencies) {
     }
     
     // 2. Detect typosquatting
-    const typosquatWarnings = detectTyposquatting(packageName, database);
+    const typosquatWarnings = detectTyposquatting(packageName, version, database);
     warnings.push(...typosquatWarnings);
   }