npq 3.3.0 → 3.4.0

package/lib/marshalls/typosquatting.marshall.js

@@ -0,0 +1,50 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
+
+const path = require('path')
+const levenshtein = require('fast-levenshtein')
+const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
+
+const MARSHALL_NAME = 'typosquatting'
+
+class Marshall extends BaseMarshall {
+  constructor(options) {
+    super(options)
+    this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.PackageHealth.id
+  }
+
+  title() {
+    return 'Checking for typosquatting'
+  }
+
+  validate(pkg) {
+    let levenshteinDistance = null
+    let similarPackages = []
+    return new Promise((resolve, reject) => {
+      for (const popularPackageNameInRepository of topPackagesRawJSON) {
+        levenshteinDistance = levenshtein.get(pkg.packageName, popularPackageNameInRepository)
+
+        if (levenshteinDistance < 3) {
+          similarPackages.push(popularPackageNameInRepository)
+        }
+      }
+
+      if (similarPackages.length > 0) {
+        return reject(
+          new Error(
+            `Package name could be a typosquatting attempt for popular package(s): ${similarPackages.join(
+              ', '
+            )}`
+          )
+        )
+      }
+
+      return resolve([])
+    })
+  }
+}
+
+module.exports = Marshall

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -170,6 +170,7 @@
     }
   },
   "dependencies": {
+    "fast-levenshtein": "^3.0.0",
     "glob": "^10.3.10",
     "inquirer": "^8.2.6",
     "kleur": "^4.1.5",