ghostpkg 0.19.0__tar.gz → 0.19.2__tar.gz

{ghostpkg-0.19.0 → ghostpkg-0.19.2}/CHANGELOG.md

@@ -6,6 +6,77 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.19.2] - 2026-09-02
+
+Found by throwing hostile input at the parsers rather than by reading them.
+
+### Fixed
+- **A byte-order mark broke seven of the eight manifest formats, four of them
+  silently.** A file saved by Notepad, PowerShell's `Out-File`, or an editor set
+  to "UTF-8 with BOM" starts with U+FEFF. `pyproject.toml`, `package.json` and
+  `package-lock.json` raised a parse error; `poetry.lock`, `pnpm-lock.yaml` and
+  prose files returned **zero** packages; `requirements.txt` dropped only its
+  first line and the run then reported that everything looked fine. Files are
+  now read as `utf-8-sig`, which strips the mark when present and is identical
+  to `utf-8` when it is not, and every parser that takes text strips it too.
+- **An empty dependency key is no longer treated as a package name.**
+  `{"dependencies": {"": "^1"}}` produced an empty name, and the npm client then
+  requested `https://registry.npmjs.org/` -- the registry root -- and read
+  whatever came back as facts about it.
+- **`===` is recognised as a pin.** PEP 440 arbitrary equality is the only way
+  to name a version that does not normalise, and such a pin was never checked.
+- **A different spelling of a popular name is not a typo of it.** PyPI treats
+  `-`, `_` and `.` as one separator, so `typing_extensions` and
+  `typing-extensions` are the same project; comparing the raw spelling against
+  the popular-name list missed the match and made the package a one-edit typo of
+  itself. Unreachable in the product -- PyPI resolves both spellings, so the
+  name always exists -- but `nearest_popular` is public and the reasoning cost
+  more to reconstruct than the fix. npm names are still compared as written,
+  because `JSONStream` and `jsonstream` are two different real packages there.
+
+### Considered and rejected
+- **Reading `setup.py` with `ast`, without executing it.** Attractive on the
+  raw count -- 1.4M repositories have one. Measured across sixteen well-known
+  Python projects: **zero** had an `install_requires` an AST could read. Eight
+  have no `setup.py` at all, five have one with no `install_requires`, and three
+  compute it at runtime. The parser would read nothing on real projects.
+- **Auditing the installed environment.** The idea was to catch a package that
+  was removed from the registry after it was installed. Across 103 distributions
+  in four environments, **none** was missing upstream, so the case cannot be
+  verified -- and everything else such a command could report is the soft
+  signals that already measured 100% false on age alone.
+
+## [0.19.1] - 2026-09-02
+
+### Documentation
+Both READMEs had fallen behind the tool. The PyPI page is the English one, so
+this is what people read before installing anything.
+
+- **New section: monorepos and private packages.** The rule that a dependency
+  naming its own source is not the registry's business arrived in 0.15.0 and was
+  never written down -- so a monorepo user had no way to know it works. A table
+  now names every form: `workspace:`, `catalog:`, `file:`, `link:`, `portal:`,
+  git and URL specifiers, `npm:` aliases, `[tool.uv.sources]`, Poetry
+  `{ git = ... }`, `[package.source]`, and workspace members in a lockfile.
+  Private registries are covered too, with the reason they are left alone.
+- **New section: measured, and not built.** Seven ideas that were prototyped,
+  measured and dropped, each with its number: the 100% false-positive scoring
+  design, `os.environ` at 37%, the age gate at 2.54%, cached negatives, PEP 740
+  attestations at a 5% overlap, npm `deprecated` at 5.78%, and the hallucinated-name
+  corpus rejected on principle. What a security tool refuses to do says more
+  about its judgement than its feature list.
+- The signals table documents the `did you mean ...?` suggestion, and the
+  examples show the file and line a finding came from.
+- The manifest table now states what `pyproject.toml` skips via
+  `[tool.uv.sources]`, what `poetry.lock` and `uv.lock` skip via their source
+  fields, and that prose extraction reads commands written inside a sentence.
+- Prose numbers updated to the current measurement: 18 names across 22 READMEs,
+  0% that do not exist.
+
+Rendering was checked with `readme_renderer`, the library PyPI itself uses:
+41,576 characters, 11 tables, no relative links and no images that resolve only
+on GitHub.
+
 ## [0.19.0] - 2026-09-02
 
 Both of these came out of an acceptance pass against the published package
@@ -662,7 +733,9 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.19.0...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.19.2...HEAD
+[0.19.2]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.2
+[0.19.1]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.1
 [0.19.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.0
 [0.18.1]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.18.1
 [0.18.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.18.0

{ghostpkg-0.19.0 → ghostpkg-0.19.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.19.0
+Version: 0.19.2
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -75,10 +75,12 @@ Language models invent library names. Attackers register those names in advance.
 - [What ghostpkg does](#what-ghostpkg-does)
 - [Install](#install)
 - [Usage](#usage)
+- [Monorepos and private packages](#monorepos-and-private-packages)
 - [Every signal it checks](#every-signal-it-checks)
 - [Why it doesn't block on "suspicious"](#why-it-doesnt-block-on-suspicious)
 - [Where it fits in your workflow](#where-it-fits-in-your-workflow)
 - [How it works internally](#how-it-works-internally)
+- [Measured, and not built](#measured-and-not-built)
 - [Comparison](#comparison)
 - [Honest limitations](#honest-limitations)
 - [Prior art and credit](#prior-art-and-credit)
@@ -167,13 +169,13 @@ ghostpkg scan package.json
 | Manifest | What is read |
 |---|---|
 | `requirements*.txt` | Every requirement line. Comments, flags, VCS URLs and direct links are skipped. |
-| `pyproject.toml` | PEP 621 `project.dependencies` and `project.optional-dependencies`, plus Poetry's `tool.poetry` groups. `[build-system] requires` is not included, and the `python` constraint is not treated as a package. |
+| `pyproject.toml` | PEP 621 `project.dependencies` and `project.optional-dependencies`, PEP 735 `dependency-groups`, and Poetry's `tool.poetry` groups. `[build-system] requires` is not included, the `python` constraint is not treated as a package, and anything redirected by `[tool.uv.sources]` is left alone. |
 | `package.json` | `dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`. |
 | `package-lock.json` | Every locked package, both the v1 nested and v2/v3 `packages` layouts. Workspace members and anything resolved from git, a path or a private registry are skipped. |
 | `yarn.lock` | Every locked package, classic (v1) and berry (v2+). Aliases are checked under the name that actually gets installed. |
 | `pnpm-lock.yaml` | Every locked package, lockfile versions 5, 6 and 9. |
-| `poetry.lock`, `uv.lock` | Every locked package. |
-| `README`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `*.md` | Package names out of install commands written in prose. |
+| `poetry.lock`, `uv.lock` | Every locked package. Poetry's `[package.source]` and uv's `source = { git = ... }` mean the entry came from somewhere other than the index, so it is skipped. |
+| `README`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `*.md` | Package names out of install commands written in prose — including commands written inside a sentence, in a backtick span. |
 
 **Why prose matters:** the hallucination arrives before the manifest does. A
 model writes `pip install foo-bar` into a README or an agent instruction file,
@@ -215,6 +217,36 @@ Anything else is **refused with an error rather than guessed at**. Guessing is
 what made an earlier version read `pyproject.toml` with the requirements parser
 and report TOML keys as package names.
 
+### Monorepos and private packages
+
+A dependency that **states where it comes from** is not the public registry's
+business, and `ghostpkg` does not look it up. Without that rule a monorepo is a
+wall of false blocks — measured on one real `package.json`, **six entries out of
+nine**.
+
+| Written as | What happens |
+|---|---|
+| `"@acme/ui": "workspace:*"`, `"catalog:default"` | Skipped — resolved inside the repository |
+| `"lib": "file:../lib"`, `"link:"`, `"portal:"`, `"../sibling"` | Skipped — a directory on disk |
+| `"forked": "git+https://..."`, `"owner/repo"`, `"github:owner/repo"` | Skipped — a git host |
+| `"dep": "https://.../x.tgz"` | Skipped — a URL |
+| `"ui": "npm:@scope/real@^2"` | Checked as **`@scope/real`** — an alias installs a different name than the key |
+| `internal @ git+https://...` in a requirements file | Skipped |
+| `[tool.uv.sources]`, Poetry `{ git = ... }` / `{ path = ... }` / `{ workspace = true }` | Skipped |
+| `[package.source]` in `poetry.lock`, `source = { git = ... }` in `uv.lock` | Skipped |
+| A `package-lock.json` entry that is a workspace member, or resolved from git | Skipped |
+
+The same rule covers a **private registry**. Artifactory, Nexus and Verdaccio
+proxy public names *and* host private ones under the same host, and a lockfile
+does not say which is which — so those entries are left alone rather than
+guessed at. Known public mirrors (`registry.yarnpkg.com`,
+`registry.npmmirror.com`) serve the public namespace, so they are still checked.
+
+> This was found by pointing `ghostpkg` at `pydantic`'s own `pyproject.toml`,
+> which it blocked. `pydantic-docs` is declared in a dependency group and
+> redirected to a git repository by `[tool.uv.sources]`; it is not on PyPI, and
+> reporting that as a missing dependency was simply wrong.
+
 ### Options
 
 | Flag | Purpose |
@@ -328,6 +360,7 @@ $ ghostpkg check somepkgthatisnotreal9911 --json
 | Signal | Verdict | Why |
 |---|---|---|
 | Not in the registry | 🔴 **Blocked** | The name is a ghost. There is nothing to install, and this is exactly what a hallucination looks like. |
+| ...and it is one or two edits from a popular name | 🔴 Blocked, **with a suggestion** | `did you mean requests?` The age gate that guards this comparison elsewhere exists to stop a legitimate published package being called a typo — a name that does not exist has none of that to protect and is already blocked, so naming the likely intent can only help. Correct on 11 of 11 plausible typos; silent on 6 of 6 invented names. |
 | The registry confiscated this name over malware | 🔴 **Blocked** | npm replaces such a name with a placeholder it owns rather than deleting it, so the name still resolves — which is why this used to come back "ok". `crossenv` and `ffmepg` are real examples. |
 | A pinned version the maintainer withdrew | 🟡 Warning | Reported with the reason they gave. It warns rather than blocks because pip installs a yanked version when it is pinned explicitly. PyPI only: npm's `deprecated` covers 5.78% of versions and 160 of `glob`'s 168, so it is noise. |
 | A pinned version that does not exist | 🔴 **Blocked** | `requests==99.99.99`. A model invents versions as readily as names, and the registry lists every real one, so this is a lookup rather than a heuristic. Only exact pins are checked — a range like `>=2.31` or `^4.18.0` may be satisfied by some other version. |
@@ -368,6 +401,17 @@ $ ghostpkg check react-router-dom-utils -e npm
            - no repository or homepage link
 ```
 
+When the name does not exist at all, the block comes with the likely intent
+attached, and — in a scan — the file and line it was written on:
+
+```console
+$ ghostpkg scan requirements.txt
+
+  BLOCKED  reqeusts  (requirements.txt:12)
+           - does not exist on pypi
+           - did you mean requests?
+```
+
 There is a second lesson baked into the code. A naive typosquat check using a flat
 edit-distance budget flagged `flask`, `click` and `black` as typos **of each other** —
 short popular names sit inherently close together. The budget now scales with name
@@ -518,6 +562,31 @@ be caught, and packages published without an sdist cannot be inspected at all.
 
 ---
 
+## Measured, and not built
+
+Each of these was proposed, prototyped, measured, and dropped. They are listed
+because what a security tool **refuses** to do says more about its judgement
+than its feature list does — every one of them would have looked reasonable in a
+changelog.
+
+| Idea | What the measurement showed | |
+|---|---|---|
+| Score packages by age and release count, block the suspicious ones | **100%** of legitimate same-day PyPI publications flagged | Rejected |
+| Treat reading `os.environ` in an install script as a signal | **37%** of established packages do it | Rejected |
+| Drop the age gate on typo detection | **2.54%** false positives; only the pair of conditions reaches 0% | Rejected |
+| Cache "does not exist" for an hour | A **real false block** of a live package: PyPI's feed announces a name before the JSON API serves it | Negatives are never cached |
+| PEP 740 attestations as a *suppressor* of warnings | Of 38 packages, 13 had an attestation and 8 lacked a repository link — **2 were in both groups** | 5% benefit for two extra requests. Rejected |
+| npm's `deprecated` as an equivalent of PyPI's `yanked` | **5.78%** of all versions, and 160 of `glob`'s 168 | Noise. Rejected |
+| Ship a corpus of known hallucinated names | — | A ready-made target list for attackers. Rejected on principle |
+
+The attestation one is worth a sentence, because it was the most attractive
+idea of the set: it would have *removed* warnings rather than adding signals.
+It failed on the logic, not the numbers — an attestation proves **provenance,
+not benevolence**. An attacker can publish a slopsquat through Trusted
+Publishing from their own repository just as easily.
+
+---
+
 ## Comparison
 
 | | `ghostpkg` | SCA scanners (Snyk, Socket) | `pip install` alone |

{ghostpkg-0.19.0 → ghostpkg-0.19.2}/README.en.md

@@ -27,10 +27,12 @@ Language models invent library names. Attackers register those names in advance.
 - [What ghostpkg does](#what-ghostpkg-does)
 - [Install](#install)
 - [Usage](#usage)
+- [Monorepos and private packages](#monorepos-and-private-packages)
 - [Every signal it checks](#every-signal-it-checks)
 - [Why it doesn't block on "suspicious"](#why-it-doesnt-block-on-suspicious)
 - [Where it fits in your workflow](#where-it-fits-in-your-workflow)
 - [How it works internally](#how-it-works-internally)
+- [Measured, and not built](#measured-and-not-built)
 - [Comparison](#comparison)
 - [Honest limitations](#honest-limitations)
 - [Prior art and credit](#prior-art-and-credit)
@@ -119,13 +121,13 @@ ghostpkg scan package.json
 | Manifest | What is read |
 |---|---|
 | `requirements*.txt` | Every requirement line. Comments, flags, VCS URLs and direct links are skipped. |
-| `pyproject.toml` | PEP 621 `project.dependencies` and `project.optional-dependencies`, plus Poetry's `tool.poetry` groups. `[build-system] requires` is not included, and the `python` constraint is not treated as a package. |
+| `pyproject.toml` | PEP 621 `project.dependencies` and `project.optional-dependencies`, PEP 735 `dependency-groups`, and Poetry's `tool.poetry` groups. `[build-system] requires` is not included, the `python` constraint is not treated as a package, and anything redirected by `[tool.uv.sources]` is left alone. |
 | `package.json` | `dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`. |
 | `package-lock.json` | Every locked package, both the v1 nested and v2/v3 `packages` layouts. Workspace members and anything resolved from git, a path or a private registry are skipped. |
 | `yarn.lock` | Every locked package, classic (v1) and berry (v2+). Aliases are checked under the name that actually gets installed. |
 | `pnpm-lock.yaml` | Every locked package, lockfile versions 5, 6 and 9. |
-| `poetry.lock`, `uv.lock` | Every locked package. |
-| `README`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `*.md` | Package names out of install commands written in prose. |
+| `poetry.lock`, `uv.lock` | Every locked package. Poetry's `[package.source]` and uv's `source = { git = ... }` mean the entry came from somewhere other than the index, so it is skipped. |
+| `README`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `*.md` | Package names out of install commands written in prose — including commands written inside a sentence, in a backtick span. |
 
 **Why prose matters:** the hallucination arrives before the manifest does. A
 model writes `pip install foo-bar` into a README or an agent instruction file,
@@ -167,6 +169,36 @@ Anything else is **refused with an error rather than guessed at**. Guessing is
 what made an earlier version read `pyproject.toml` with the requirements parser
 and report TOML keys as package names.
 
+### Monorepos and private packages
+
+A dependency that **states where it comes from** is not the public registry's
+business, and `ghostpkg` does not look it up. Without that rule a monorepo is a
+wall of false blocks — measured on one real `package.json`, **six entries out of
+nine**.
+
+| Written as | What happens |
+|---|---|
+| `"@acme/ui": "workspace:*"`, `"catalog:default"` | Skipped — resolved inside the repository |
+| `"lib": "file:../lib"`, `"link:"`, `"portal:"`, `"../sibling"` | Skipped — a directory on disk |
+| `"forked": "git+https://..."`, `"owner/repo"`, `"github:owner/repo"` | Skipped — a git host |
+| `"dep": "https://.../x.tgz"` | Skipped — a URL |
+| `"ui": "npm:@scope/real@^2"` | Checked as **`@scope/real`** — an alias installs a different name than the key |
+| `internal @ git+https://...` in a requirements file | Skipped |
+| `[tool.uv.sources]`, Poetry `{ git = ... }` / `{ path = ... }` / `{ workspace = true }` | Skipped |
+| `[package.source]` in `poetry.lock`, `source = { git = ... }` in `uv.lock` | Skipped |
+| A `package-lock.json` entry that is a workspace member, or resolved from git | Skipped |
+
+The same rule covers a **private registry**. Artifactory, Nexus and Verdaccio
+proxy public names *and* host private ones under the same host, and a lockfile
+does not say which is which — so those entries are left alone rather than
+guessed at. Known public mirrors (`registry.yarnpkg.com`,
+`registry.npmmirror.com`) serve the public namespace, so they are still checked.
+
+> This was found by pointing `ghostpkg` at `pydantic`'s own `pyproject.toml`,
+> which it blocked. `pydantic-docs` is declared in a dependency group and
+> redirected to a git repository by `[tool.uv.sources]`; it is not on PyPI, and
+> reporting that as a missing dependency was simply wrong.
+
 ### Options
 
 | Flag | Purpose |
@@ -280,6 +312,7 @@ $ ghostpkg check somepkgthatisnotreal9911 --json
 | Signal | Verdict | Why |
 |---|---|---|
 | Not in the registry | 🔴 **Blocked** | The name is a ghost. There is nothing to install, and this is exactly what a hallucination looks like. |
+| ...and it is one or two edits from a popular name | 🔴 Blocked, **with a suggestion** | `did you mean requests?` The age gate that guards this comparison elsewhere exists to stop a legitimate published package being called a typo — a name that does not exist has none of that to protect and is already blocked, so naming the likely intent can only help. Correct on 11 of 11 plausible typos; silent on 6 of 6 invented names. |
 | The registry confiscated this name over malware | 🔴 **Blocked** | npm replaces such a name with a placeholder it owns rather than deleting it, so the name still resolves — which is why this used to come back "ok". `crossenv` and `ffmepg` are real examples. |
 | A pinned version the maintainer withdrew | 🟡 Warning | Reported with the reason they gave. It warns rather than blocks because pip installs a yanked version when it is pinned explicitly. PyPI only: npm's `deprecated` covers 5.78% of versions and 160 of `glob`'s 168, so it is noise. |
 | A pinned version that does not exist | 🔴 **Blocked** | `requests==99.99.99`. A model invents versions as readily as names, and the registry lists every real one, so this is a lookup rather than a heuristic. Only exact pins are checked — a range like `>=2.31` or `^4.18.0` may be satisfied by some other version. |
@@ -320,6 +353,17 @@ $ ghostpkg check react-router-dom-utils -e npm
            - no repository or homepage link
 ```
 
+When the name does not exist at all, the block comes with the likely intent
+attached, and — in a scan — the file and line it was written on:
+
+```console
+$ ghostpkg scan requirements.txt
+
+  BLOCKED  reqeusts  (requirements.txt:12)
+           - does not exist on pypi
+           - did you mean requests?
+```
+
 There is a second lesson baked into the code. A naive typosquat check using a flat
 edit-distance budget flagged `flask`, `click` and `black` as typos **of each other** —
 short popular names sit inherently close together. The budget now scales with name
@@ -470,6 +514,31 @@ be caught, and packages published without an sdist cannot be inspected at all.
 
 ---
 
+## Measured, and not built
+
+Each of these was proposed, prototyped, measured, and dropped. They are listed
+because what a security tool **refuses** to do says more about its judgement
+than its feature list does — every one of them would have looked reasonable in a
+changelog.
+
+| Idea | What the measurement showed | |
+|---|---|---|
+| Score packages by age and release count, block the suspicious ones | **100%** of legitimate same-day PyPI publications flagged | Rejected |
+| Treat reading `os.environ` in an install script as a signal | **37%** of established packages do it | Rejected |
+| Drop the age gate on typo detection | **2.54%** false positives; only the pair of conditions reaches 0% | Rejected |
+| Cache "does not exist" for an hour | A **real false block** of a live package: PyPI's feed announces a name before the JSON API serves it | Negatives are never cached |
+| PEP 740 attestations as a *suppressor* of warnings | Of 38 packages, 13 had an attestation and 8 lacked a repository link — **2 were in both groups** | 5% benefit for two extra requests. Rejected |
+| npm's `deprecated` as an equivalent of PyPI's `yanked` | **5.78%** of all versions, and 160 of `glob`'s 168 | Noise. Rejected |
+| Ship a corpus of known hallucinated names | — | A ready-made target list for attackers. Rejected on principle |
+
+The attestation one is worth a sentence, because it was the most attractive
+idea of the set: it would have *removed* warnings rather than adding signals.
+It failed on the logic, not the numbers — an attestation proves **provenance,
+not benevolence**. An attacker can publish a slopsquat through Trusted
+Publishing from their own repository just as easily.
+
+---
+
 ## Comparison
 
 | | `ghostpkg` | SCA scanners (Snyk, Socket) | `pip install` alone |

{ghostpkg-0.19.0 → ghostpkg-0.19.2}/README.md

@@ -122,8 +122,12 @@ Lock-файли варто перевіряти навіть якщо ви вж
 пише `pip install foo-bar` у README, людина копіює рядок — і встановлення вже відбулось,
 коли назва тільки потрапляє в `requirements.txt`.
 
+Читаються й команди, написані **всередині речення**, у зворотних лапках —
+*«Install using `pip install -U pydantic`»*. Три з чотирнадцяти популярних README
+пишуть їх лише так, і читання цілих рядків не знаходило в них нічого.
+
 Витяг навмисно вузький, бо README повний слів, схожих на назви пакетів. Замір на
-13 реальних README: справжні назви знаходяться, **хибних спрацювань 0%**.
+22 реальних README: **18 назв, хибних спрацювань 0%**.
 
 Можна передати кілька файлів одразу, навіть із різних екосистем:
 
@@ -145,6 +149,37 @@ ghostpkg scan ../інший-проєкт
 
 ---
 
+## Монорепо й приватні пакети
+
+Залежність, яка **сама називає своє джерело**, публічного реєстру не стосується —
+і `ghostpkg` її не шукає. Без цього правила монорепо перетворюється на стіну
+хибних блокувань: замір на одному справжньому `package.json` дав **шість із дев'яти**.
+
+| Як написано | Що відбувається |
+|---|---|
+| `"@acme/ui": "workspace:*"`, `"catalog:default"` | Пропускаємо — вирішується всередині репозиторію |
+| `"lib": "file:../lib"`, `"link:"`, `"portal:"`, `"../sibling"` | Пропускаємо — тека на диску |
+| `"forked": "git+https://..."`, `"owner/repo"`, `"github:owner/repo"` | Пропускаємо — git-хост |
+| `"dep": "https://.../x.tgz"` | Пропускаємо — URL |
+| `"ui": "npm:@scope/real@^2"` | Перевіряємо **`@scope/real`** — псевдонім встановлює не те, що в ключі |
+| `internal @ git+https://...` у requirements | Пропускаємо |
+| `[tool.uv.sources]`, Poetry `{ git = ... }` / `{ path = ... }` | Пропускаємо |
+| `[package.source]` у `poetry.lock`, `source = { git = ... }` в `uv.lock` | Пропускаємо |
+| Учасник робочої області або git-джерело в `package-lock.json` | Пропускаємо |
+
+Те саме правило закриває **приватний реєстр**. Artifactory, Nexus і Verdaccio
+проксюють публічні імена **і** хостять власні під тим самим хостом, а lock-файл
+не каже, що є що — тож такі записи ми лишаємо без судження, а не вгадуємо.
+Публічні дзеркала (`registry.yarnpkg.com`, `registry.npmmirror.com`) перевіряємо
+далі, бо вони віддають той самий публічний простір імен.
+
+> Це знайшлося, коли `ghostpkg` навели на власний `pyproject.toml` проєкту
+> `pydantic` — і він його заблокував. `pydantic-docs` оголошено в групі
+> залежностей і перенаправлено на git через `[tool.uv.sources]`; на PyPI його
+> немає, і називати це відсутньою залежністю було просто неправильно.
+
+---
+
 ## Куди це вбудовується
 
 ### У CI
@@ -187,6 +222,7 @@ repos:
 | Сигнал | Вердикт |
 |---|---|
 | Немає в реєстрі | 🔴 **Заблоковано.** Назва — привид, встановлювати нічого. |
+| ...і вона за один-два символи від популярної | 🔴 Заблоковано **з підказкою**: `did you mean requests?` Віковий фільтр, який стримує це порівняння в інших місцях, захищає легітимні пакети від звинувачення в опечатці — у неіснуючої назви захищати нічого, вона вже заблокована. Замір: правильно 11 з 11 на опечатках, мовчить 6 з 6 на вигаданих назвах. |
 | Реєстр вилучив це ім'я через шкідливість | 🔴 **Заблоковано.** npm не видаляє таке ім'я, а замінює його заглушкою — тому воно досі відповідає, і раніше ми казали «ok». Приклади: `crossenv`, `ffmepg`. |
 | Закріплену версію відкликав мейнтейнер | 🟡 Попередження з його ж поясненням. Не блокування: `pip` встановлює відкликану версію, якщо її закріпили явно. |
 | Закріплена версія не існує (`requests==99.99.99`) | 🔴 **Заблоковано.** Вигадана версія — той самий клас помилки, що й вигадана назва. Діапазони (`>=2.31`, `^4.18`) не перевіряються: їх може задовольнити інша версія. |
@@ -291,6 +327,29 @@ ghostpkg scan requirements.txt --config ~/ghostpkg-ignore.json
 
 ---
 
+## Заміряно — і не побудовано
+
+Кожну з цих ідей запропоновано, зроблено прототип, заміряно й відкинуто. Вони тут
+тому, що **відмови** інструменту безпеки кажуть про його судження більше, ніж
+перелік можливостей: кожна з них добре виглядала б у чейнджлозі.
+
+| Ідея | Що показав замір | |
+|---|---|---|
+| Оцінювати пакети за віком і кількістю релізів, блокувати підозрілі | **100%** легітимних публікацій того самого дня позначено | Відхилено |
+| Вважати читання `os.environ` у скрипті встановлення сигналом | **37%** усталених пакетів це роблять | Відхилено |
+| Прибрати віковий фільтр із детектора опечаток | **2,54%** хибних; нуля досягає лише пара умов | Відхилено |
+| Кешувати «не існує» на годину | **Справжнє хибне блокування** живого пакета: стрічка PyPI оголошує ім'я раніше, ніж його віддає JSON API | Негативні відповіді не кешуються |
+| Атестації PEP 740 як **гасник** попереджень | З 38 пакетів 13 мали атестацію, 8 не мали посилання на репозиторій — **в обох групах лише 2** | Користь 5% за два зайві запити. Відхилено |
+| npm `deprecated` як аналог `yanked` у PyPI | **5,78%** усіх версій, і 160 зі 168 у `glob` | Шум. Відхилено |
+| Постачати перелік відомих галюцинованих імен | — | Готовий перелік цілей для атакуючого. Відхилено принципово |
+
+Про атестації варто окреме речення, бо це була найпривабливіша ідея набору: вона
+**знімала** б попередження, а не додавала сигнали. Провалилась вона на логіці, не
+на числах — атестація доводить **походження, а не добросовісність**. Зловмисник
+так само може опублікувати слопсквот через Trusted Publishing зі свого репозиторію.
+
+---
+
 ## Порівняння
 
 | | `ghostpkg` | SCA-сканери (Snyk, Socket) | Просто `pip install` |

{ghostpkg-0.19.0 → ghostpkg-0.19.2}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.19.0"
+__version__ = "0.19.2"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.19.0 → ghostpkg-0.19.2}/ghostpkg/assess.py

@@ -40,7 +40,10 @@ NEW_DAYS = 365
 # An exact pin, and only an exact pin. `>=`, `^`, `~` and wildcards describe a
 # range that the registry may satisfy with some other version, so there is
 # nothing definite to check. `==1.2.3` either exists or it does not.
-PYPI_PIN = re.compile(r"^\s*==\s*([A-Za-z0-9][A-Za-z0-9.\-+!]*)\s*$")
+#: `===` is PEP 440 arbitrary equality -- a pin like any other, and the only
+#: way to name a version that is not PEP 440 normalisable. Missing it meant
+#: such a pin was never checked at all.
+PYPI_PIN = re.compile(r"^\s*={2,3}\s*([A-Za-z0-9][A-Za-z0-9.\-+!]*)\s*$")
 NPM_PIN = re.compile(r"^\s*v?(\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.\-]+)?)\s*$")
 
 
@@ -48,6 +51,7 @@ def exact_pin(specifier: str | None, ecosystem: str) -> str | None:
     """The single version a specifier demands, if it demands exactly one."""
     if not specifier:
         return None
+    specifier = specifier.split(";", 1)[0]
     pattern = NPM_PIN if ecosystem == "npm" else PYPI_PIN
     match = pattern.match(specifier)
     if not match:
@@ -152,13 +156,32 @@ def _typo_budget(name: str) -> int:
     return 2 if len(name) >= 10 else 1
 
 
+def _normalise(name: str, ecosystem: str) -> str:
+    """The name as its own registry understands it.
+
+    PyPI treats `-`, `_` and `.` as one separator and ignores case (PEP 503),
+    so `typing_extensions` and `typing-extensions` are the same project. Without
+    this the popular-name list was missed on the underscore spelling and the
+    same package came back as a one-edit typo of itself. It is unreachable
+    today -- PyPI resolves both spellings, so such a name always exists and
+    never reaches the comparison -- but the function is public and the next
+    reader should not have to work that out.
+
+    npm does no such folding: `JSONStream` and `jsonstream` are two real and
+    different packages, so its names are compared as written.
+    """
+    if ecosystem == "pypi":
+        return re.sub(r"[-_.]+", "-", name).lower()
+    return name.lower()
+
+
 def _comparable(name: str, ecosystem: str) -> str:
     """The part of a name worth comparing.
 
     An npm squat on a scoped package targets the part after the slash, since
     the scope is usually owned by whoever it names.
     """
-    lowered = name.lower()
+    lowered = _normalise(name, ecosystem)
     if ecosystem == "npm" and lowered.startswith("@") and "/" in lowered:
         return lowered.rsplit("/", 1)[1]
     return lowered
@@ -170,7 +193,7 @@ def nearest_popular(name: str, ecosystem: str = "pypi") -> tuple[str, int] | Non
     if not popular:
         return None
 
-    lowered = name.lower()
+    lowered = _normalise(name, ecosystem)
     target = _comparable(name, ecosystem)
 
     if lowered in popular or target in popular: