npq 3.5.3 → 3.5.5

package/README.md

@@ -108,6 +108,24 @@ Example, to disable the Snyk vulnerability marshall:
 MARSHALL_DISABLE_SNYK=1 npq install express
 ```
 
+#### Available Marshall Environment Variables
+
+Here are all the available environment variable names for disabling specific marshalls:
+
+| Marshall Name | Environment Variable | Description |
+| --- | --- | --- |
+| age | `MARSHALL_DISABLE_AGE` | Disable package age checks |
+| author | `MARSHALL_DISABLE_AUTHOR` | Disable package author verification |
+| downloads | `MARSHALL_DISABLE_DOWNLOADS` | Disable download count checks |
+| expired domains | `MARSHALL_DISABLE_MAINTAINERS_EXPIRED_EMAILS` | Disable expired domain checks for maintainer emails |
+| license | `MARSHALL_DISABLE_LICENSE` | Disable license availability checks |
+| provenance | `MARSHALL_DISABLE_PROVENANCE` | Disable package provenance verification |
+| repo | `MARSHALL_DISABLE_REPO` | Disable repository URL validation |
+| scripts | `MARSHALL_DISABLE_SCRIPTS` | Disable pre/post install script checks |
+| signatures | `MARSHALL_DISABLE_SIGNATURES` | Disable registry signature verification |
+| snyk | `MARSHALL_DISABLE_SNYK` | Disable Snyk vulnerability checks |
+| typosquatting | `MARSHALL_DISABLE_TYPOSQUATTING` | Disable typosquatting detection |
+
 ### Run checks on package without installing it:
 
 ```sh

package/__tests__/marshalls.typosquatting.test.js

@@ -0,0 +1,67 @@
+const TyposquattingMarshall = require('../lib/marshalls/typosquatting.marshall')
+
+describe('Typosquatting Marshall', () => {
+  test('should remove duplicate entries from similar packages', async () => {
+    const typosquattingMarshall = new TyposquattingMarshall({
+      packageRepoUtils: null
+    })
+
+    // Mock the top packages data to include duplicates
+    const originalTopPackages = require('../data/top-packages.json')
+    
+    // Create a test package that would match multiple similar packages
+    const pkg = {
+      packageName: 'ghtml' // This should match 'html' which appears multiple times in the data
+    }
+
+    try {
+      await typosquattingMarshall.validate(pkg)
+      // If no error is thrown, the test should fail
+      expect(true).toBe(false)
+    } catch (error) {
+      // Check that the error message doesn't contain duplicate entries
+      const errorMessage = error.message
+      expect(errorMessage).toContain('Package name could be a typosquatting attempt for popular package(s):')
+      
+      // Extract the package names from the error message
+      const packagesList = errorMessage.split('popular package(s): ')[1]
+      const packages = packagesList.split(', ')
+      
+      // Check that there are no duplicates
+      const uniquePackages = [...new Set(packages)]
+      expect(packages.length).toBe(uniquePackages.length)
+      
+      // Verify that 'html' appears only once even though it exists multiple times in the data
+      const htmlCount = packages.filter(pkg => pkg === 'html').length
+      expect(htmlCount).toBe(1)
+    }
+  })
+
+  test('should not report typosquatting for packages in top packages list', async () => {
+    const typosquattingMarshall = new TyposquattingMarshall({
+      packageRepoUtils: null
+    })
+
+    // Test with a package that exists in the top packages list
+    const pkg = {
+      packageName: 'express' // This should be in the top packages list
+    }
+
+    const result = await typosquattingMarshall.validate(pkg)
+    expect(result).toEqual([])
+  })
+
+  test('should not report typosquatting for packages with no similar matches', async () => {
+    const typosquattingMarshall = new TyposquattingMarshall({
+      packageRepoUtils: null
+    })
+
+    // Test with a package that has no similar matches
+    const pkg = {
+      packageName: 'verylonganduniquenamethatdoesnotmatchanything'
+    }
+
+    const result = await typosquattingMarshall.validate(pkg)
+    expect(result).toEqual([])
+  })
+})

package/lib/marshalls/typosquatting.marshall.js

@@ -41,9 +41,11 @@ class Marshall extends BaseMarshall {
       }
 
       if (similarPackages.length > 0) {
+        // Remove duplicates from similarPackages array
+        const uniqueSimilarPackages = [...new Set(similarPackages)]
         return reject(
           new Error(
-            `Package name could be a typosquatting attempt for popular package(s): ${similarPackages.join(
+            `Package name could be a typosquatting attempt for popular package(s): ${uniqueSimilarPackages.join(
               ', '
             )}`
           )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.5.3",
+  "version": "3.5.5",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",