npq 3.2.3 → 3.4.0

package/lib/marshalls/typosquatting.marshall.js

@@ -0,0 +1,50 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
+
+const path = require('path')
+const levenshtein = require('fast-levenshtein')
+const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
+
+const MARSHALL_NAME = 'typosquatting'
+
+class Marshall extends BaseMarshall {
+  constructor(options) {
+    super(options)
+    this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.PackageHealth.id
+  }
+
+  title() {
+    return 'Checking for typosquatting'
+  }
+
+  validate(pkg) {
+    let levenshteinDistance = null
+    let similarPackages = []
+    return new Promise((resolve, reject) => {
+      for (const popularPackageNameInRepository of topPackagesRawJSON) {
+        levenshteinDistance = levenshtein.get(pkg.packageName, popularPackageNameInRepository)
+
+        if (levenshteinDistance < 3) {
+          similarPackages.push(popularPackageNameInRepository)
+        }
+      }
+
+      if (similarPackages.length > 0) {
+        return reject(
+          new Error(
+            `Package name could be a typosquatting attempt for popular package(s): ${similarPackages.join(
+              ', '
+            )}`
+          )
+        )
+      }
+
+      return resolve([])
+    })
+  }
+}
+
+module.exports = Marshall

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.2.3",
+  "version": "3.4.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -10,6 +10,7 @@
     "lint": "eslint . --ignore-path .gitignore && npm run lint:lockfile",
     "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --validate-https --allowed-hosts npm npm",
     "test": "NODE_OPTIONS=\"--experimental-vm-modules\" jest",
+    "build": "node scripts/build.js",
     "test:watch": "NODE_OPTIONS=\"--experimental-vm-modules\" jest --watch",
     "coverage:view": "opn coverage/lcov-report/index.html",
     "commit": "git-cz",
@@ -169,6 +170,7 @@
     }
   },
   "dependencies": {
+    "fast-levenshtein": "^3.0.0",
     "glob": "^10.3.10",
     "inquirer": "^8.2.6",
     "kleur": "^4.1.5",

package/scripts/build.js

@@ -0,0 +1,25 @@
+const fs = require('fs/promises')
+const path = require('path')
+
+const TOP_PACKAGES_ASSET_URL =
+  'https://github.com/lirantal/npm-rank/releases/download/latest/list-package-names.json'
+
+const TOP_PACKAGES_FILE_PATH = path.join(__dirname, '../data/top-packages.json')
+
+async function downloadTopPackages() {
+  const response = await fetch(TOP_PACKAGES_ASSET_URL)
+  const data = await response.json()
+  return data
+}
+
+async function saveTopPackagesToFile() {
+  const topPackages = await downloadTopPackages()
+  await fs.writeFile(TOP_PACKAGES_FILE_PATH, JSON.stringify(topPackages, null, 2))
+}
+
+async function main() {
+  const topPackages = await downloadTopPackages()
+  await saveTopPackagesToFile()
+}
+
+main()