npq 3.16.0 → 3.16.2

package/lib/helpers/levenshteinDistance.js

@@ -0,0 +1,78 @@
+'use strict'
+
+/**
+ * Calculates the Levenshtein distance between two strings.
+ * Uses the Wagner-Fischer algorithm with single-row space optimization
+ * and optional early termination when distance exceeds maxDistance.
+ *
+ * @param {string} a - First string
+ * @param {string} b - Second string
+ * @param {number} [maxDistance] - Optional maximum distance threshold for early termination
+ * @returns {number} The Levenshtein edit distance between the two strings
+ */
+function levenshteinDistance(a, b, maxDistance) {
+  // Handle edge cases
+  if (a === b) return 0
+  if (a.length === 0) return b.length
+  if (b.length === 0) return a.length
+
+  // Ensure a is the shorter string for space optimization
+  if (a.length > b.length) {
+    const temp = a
+    a = b
+    b = temp
+  }
+
+  const aLen = a.length
+  const bLen = b.length
+
+  // Early termination: if length difference exceeds maxDistance, no need to compute
+  if (maxDistance !== undefined && bLen - aLen >= maxDistance) {
+    return bLen - aLen
+  }
+
+  // Initialize the previous row (represents distances for empty string a prefix)
+  let prevRow = new Array(aLen + 1)
+  for (let i = 0; i <= aLen; i++) {
+    prevRow[i] = i
+  }
+
+  // Current row for computation
+  let currRow = new Array(aLen + 1)
+
+  // Fill in the matrix row by row
+  for (let j = 1; j <= bLen; j++) {
+    currRow[0] = j
+
+    let rowMin = currRow[0]
+
+    for (let i = 1; i <= aLen; i++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1
+
+      currRow[i] = Math.min(
+        prevRow[i] + 1, // deletion
+        currRow[i - 1] + 1, // insertion
+        prevRow[i - 1] + cost // substitution
+      )
+
+      if (currRow[i] < rowMin) {
+        rowMin = currRow[i]
+      }
+    }
+
+    // Early termination: if minimum value in current row exceeds maxDistance,
+    // the final distance will also exceed maxDistance
+    if (maxDistance !== undefined && rowMin >= maxDistance) {
+      return rowMin
+    }
+
+    // Swap rows
+    const temp = prevRow
+    prevRow = currRow
+    currRow = temp
+  }
+
+  return prevRow[aLen]
+}
+
+module.exports = { levenshteinDistance }

package/lib/helpers/sourcePackages.js

@@ -12,9 +12,20 @@ async function getProjectPackages() {
     const packageJSON = await fs.readFile(packageJSONPath, 'utf-8')
     const packageData = JSON.parse(packageJSON)
     if (packageData && packageData.dependencies) {
-      packages = Object.keys(packageData.dependencies).map((dep) => {
-        return `${dep}@${packageData.dependencies[dep]}`
-      })
+      packages = [
+        ...packages,
+        ...Object.keys(packageData.dependencies).map((dep) => {
+          return `${dep}@${packageData.dependencies[dep]}`
+        })
+      ]
+    }
+    if (packageData && packageData.devDependencies) {
+      packages = [
+        ...packages,
+        ...Object.keys(packageData.devDependencies).map((dep) => {
+          return `${dep}@${packageData.devDependencies[dep]}`
+        })
+      ]
     }
 
     return packages

package/lib/marshalls/typosquatting.marshall.js

@@ -4,7 +4,7 @@ const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 
 const path = require('path')
-const { distance } = require('fastest-levenshtein')
+const { levenshteinDistance } = require('../helpers/levenshteinDistance')
 const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
 
 const MARSHALL_NAME = 'typosquatting'
@@ -21,7 +21,7 @@ class Marshall extends BaseMarshall {
   }
 
   validate(pkg) {
-    let levenshteinDistance = null
+    let editDistance = null
     let similarPackages = []
     return new Promise((resolve, reject) => {
       // If package is within an allow-list
@@ -36,9 +36,9 @@ class Marshall extends BaseMarshall {
           return resolve([])
         }
 
-        levenshteinDistance = distance(pkg.packageName, popularPackageNameInRepository)
+        editDistance = levenshteinDistance(pkg.packageName, popularPackageNameInRepository)
 
-        if (levenshteinDistance > 0 && levenshteinDistance < 3) {
+        if (editDistance > 0 && editDistance < 3) {
           similarPackages.push(popularPackageNameInRepository)
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -43,10 +43,9 @@
     "access": "public"
   },
   "dependencies": {
-    "fastest-levenshtein": "^1.0.16",
     "npm-package-arg": "^13.0.2",
     "semver": "^7.7.3",
-    "sigstore": "^3.1.0",
+    "sigstore": "^4.0.0",
     "ssri": "^12.0.0"
   },
   "devDependencies": {