npq 3.19.6 → 3.20.0

package/lib/marshalls/typosquatting.marshall.js

@@ -6,6 +6,7 @@ const { marshallCategories } = require('./constants')
 const path = require('path')
 const { levenshteinDistance } = require('../helpers/levenshteinDistance')
 const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
+const topPackages = new Set(topPackagesRawJSON)
 
 const MARSHALL_NAME = 'typosquatting'
 
@@ -29,13 +30,13 @@ class Marshall extends BaseMarshall {
         return resolve([])
       }
 
-      for (const popularPackageNameInRepository of topPackagesRawJSON) {
-        // If the package to be installed is itself found within the Top Packages dataset
-        // then we don't report on it
-        if (pkg.packageName === popularPackageNameInRepository) {
-          return resolve([])
-        }
+      // If the package to be installed is itself found within the Top Packages dataset
+      // then we don't report on it
+      if (topPackages.has(pkg.packageName)) {
+        return resolve([])
+      }
 
+      for (const popularPackageNameInRepository of topPackagesRawJSON) {
         editDistance = levenshteinDistance(pkg.packageName, popularPackageNameInRepository)
 
         if (editDistance > 0 && editDistance < 3) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.19.6",
+  "version": "3.20.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -14,13 +14,14 @@
     "build": "node scripts/build.js",
     "test:watch": "jest --watch",
     "format": "prettier --config .prettierrc.js --write \"**/*.js\"",
-    "semantic-release": "npx semantic-release",
+    "semantic-release": "semantic-release",
     "#postinstall": "node scripts/postinstall.js",
     "#preuninstall": "node scripts/preuninstall.js",
     "prepare": "husky || true"
   },
   "engines": {
-    "node": ">=20.13.0"
+    "npm": ">=11.10.0",
+    "node": ">=24.0.0"
   },
   "files": [
     "bin/",
@@ -57,7 +58,8 @@
     "jest": "^30.3.0",
     "lint-staged": "^16.4.0",
     "lockfile-lint": "^5.0.0",
-    "prettier": "^3.6.2"
+    "prettier": "^3.6.2",
+    "semantic-release": "25.0.3"
   },
   "lint-staged": {
     "**/*.js": [

package/scripts/build.js

@@ -3,15 +3,46 @@
 const fs = require('fs/promises')
 const path = require('path')
 
-const TOP_PACKAGES_ASSET_URL =
-  'https://github.com/lirantal/npm-rank/releases/download/latest/list-package-names.json'
-
 const TOP_PACKAGES_FILE_PATH = path.join(__dirname, '../data/top-packages.json')
+const NPM_HIGH_IMPACT_TOP_PACKAGES_URL = 'https://unpkg.com/npm-high-impact@1.13.0/lib/top.js'
+const TOP_PACKAGES_EXPORT_PATTERN = /^export const top = \[\n([\s\S]*)\n\]\n?$/
+const TOP_PACKAGE_NAME_PATTERN = /^[ ]{2}'([^'\\]+)',?$/
+
+function parseTopPackages(source) {
+  const topPackagesExport = source.match(TOP_PACKAGES_EXPORT_PATTERN)
+
+  if (!topPackagesExport) {
+    throw new Error('Unexpected npm-high-impact top packages export format')
+  }
+
+  const topPackages = topPackagesExport[1].split('\n').map((line) => {
+    const packageName = line.match(TOP_PACKAGE_NAME_PATTERN)
+
+    if (!packageName) {
+      throw new Error(`Unexpected npm-high-impact package entry: ${line}`)
+    }
+
+    return packageName[1]
+  })
+
+  if (topPackages.length === 0) {
+    throw new Error('npm-high-impact top packages export is empty')
+  }
+
+  return [...new Set(topPackages)]
+}
 
 async function downloadTopPackages() {
-  const response = await fetch(TOP_PACKAGES_ASSET_URL)
-  const data = await response.json()
-  return data
+  // Keep this pinned to a published npm-high-impact artifact for reproducible builds.
+  const response = await fetch(NPM_HIGH_IMPACT_TOP_PACKAGES_URL)
+
+  if (!response.ok) {
+    throw new Error(
+      `Failed to download npm-high-impact top packages: ${response.status} ${response.statusText}`
+    )
+  }
+
+  return parseTopPackages(await response.text())
 }
 
 async function saveTopPackagesToFile() {