ghostpkg 0.2.0__tar.gz → 0.3.0__tar.gz

{ghostpkg-0.2.0 → ghostpkg-0.3.0}/CHANGELOG.md

@@ -6,6 +6,33 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-09-01
+
+### Fixed
+- **npm typo detection did not work at all.** Lookalike names were compared
+  against the 2,000 most-downloaded *PyPI* projects regardless of ecosystem, so
+  `expresss` was never flagged as a typo of `express` -- `express` was not in
+  the list being compared against.
+
+### Added
+- A list of the 2,000 most-downloaded npm packages, built from the registry's
+  own download-count API. `nearest_popular()` now picks the list matching the
+  ecosystem.
+- Scoped npm names are compared on the part after the slash, since that is what
+  a squat targets: `@evil/expresss` is flagged, `@types/node` and `@babel/core`
+  are not.
+
+### Changed
+- Typo distance is now Damerau-Levenshtein: swapping two adjacent characters
+  counts as one edit rather than two. Transposition is the commonest typosquat
+  shape, and under plain Levenshtein `recat`, `lodahs` and `webpakc` all scored
+  two edits, which put them outside the budget for names that short. All three
+  are caught now, and the false-positive rate across both 2,000-name lists is
+  still zero -- there are tests asserting exactly that.
+- Names shorter than five characters are no longer compared at all. Below that
+  the name space is too dense for edit distance to mean anything: `core` sits
+  one edit from `cors`.
+
 ## [0.2.0] - 2026-09-01
 
 ### Fixed
@@ -60,6 +87,7 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.3.0
 [0.2.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.2.0
 [0.1.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.1.0

{ghostpkg-0.2.0 → ghostpkg-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.2.0
+Version: 0.3.0
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -217,7 +217,7 @@ $ ghostpkg check somepkgthatisnotreal9911 --json
 | First published < 1 year ago | 🟡 Warning | Weaker version of the same signal. |
 | Only one release | 🟡 Warning | Squats are usually published once and abandoned. |
 | No repository or homepage link | 🟡 Warning | Real projects almost always link to source. |
-| 1–2 characters from a popular name, **and** recently published | 🟡 Warning | Classic typosquat shape. Age matters: an old lookalike is just a package with a similar name. |
+| 1–2 edits from a popular name, **and** recently published | 🟡 Warning | Classic typosquat shape. A swap of adjacent characters counts as one edit, because `recat`/`react` is what squatters actually publish. Age matters: an old lookalike is just a package with a similar name. |
 
 Warnings are advisory by default. Nothing but non-existence blocks unless you pass
 `--strict`.
@@ -353,10 +353,10 @@ earns its keep. Use both.
 > that stand between you and it, and they are advisory. Improving this is the main
 > open problem — see [issues](https://github.com/M1rwana12/ghostpkg/issues).
 
-- Typo detection compares against the 2,000 most-downloaded PyPI projects, so a squat
-  on a less popular package won't be flagged as a lookalike.
-- npm scoped packages (`@scope/name`) are checked, but the popular-name list is
-  PyPI-derived, so npm typosquat detection is weaker.
+- Typo detection compares against the 2,000 most-downloaded projects in each
+  ecosystem, so a squat on a less popular package won't be flagged as a lookalike.
+- Names shorter than five characters are not compared at all: below that the name
+  space is too dense for edit distance to mean anything.
 - Every check is a live registry request. There is no caching yet.
 - Registry outages surface as exit code `2` rather than a silent pass — deliberately,
   but it does mean a flaky network fails your build.

{ghostpkg-0.2.0 → ghostpkg-0.3.0}/README.en.md

@@ -170,7 +170,7 @@ $ ghostpkg check somepkgthatisnotreal9911 --json
 | First published < 1 year ago | 🟡 Warning | Weaker version of the same signal. |
 | Only one release | 🟡 Warning | Squats are usually published once and abandoned. |
 | No repository or homepage link | 🟡 Warning | Real projects almost always link to source. |
-| 1–2 characters from a popular name, **and** recently published | 🟡 Warning | Classic typosquat shape. Age matters: an old lookalike is just a package with a similar name. |
+| 1–2 edits from a popular name, **and** recently published | 🟡 Warning | Classic typosquat shape. A swap of adjacent characters counts as one edit, because `recat`/`react` is what squatters actually publish. Age matters: an old lookalike is just a package with a similar name. |
 
 Warnings are advisory by default. Nothing but non-existence blocks unless you pass
 `--strict`.
@@ -306,10 +306,10 @@ earns its keep. Use both.
 > that stand between you and it, and they are advisory. Improving this is the main
 > open problem — see [issues](https://github.com/M1rwana12/ghostpkg/issues).
 
-- Typo detection compares against the 2,000 most-downloaded PyPI projects, so a squat
-  on a less popular package won't be flagged as a lookalike.
-- npm scoped packages (`@scope/name`) are checked, but the popular-name list is
-  PyPI-derived, so npm typosquat detection is weaker.
+- Typo detection compares against the 2,000 most-downloaded projects in each
+  ecosystem, so a squat on a less popular package won't be flagged as a lookalike.
+- Names shorter than five characters are not compared at all: below that the name
+  space is too dense for edit distance to mean anything.
 - Every check is a live registry request. There is no caching yet.
 - Registry outages surface as exit code `2` rather than a silent pass — deliberately,
   but it does mean a flaky network fails your build.

{ghostpkg-0.2.0 → ghostpkg-0.3.0}/README.md

@@ -163,10 +163,10 @@ $ ghostpkg check react-router-dom-utils -e npm
 > попередження, і вони дорадчі. Це головна відкрита проблема —
 > див. [issues](https://github.com/M1rwana12/ghostpkg/issues).
 
-- Виявлення опечаток порівнює з 2 000 найпопулярніших проєктів PyPI, тому підробка
-  під менш популярний пакет як схожа назва не позначиться.
-- Пакети npm з областю (`@scope/name`) перевіряються, але список популярних назв
-  побудований на PyPI — тож для npm виявлення опечаток слабше.
+- Виявлення опечаток порівнює з 2 000 найпопулярніших проєктів кожної екосистеми,
+  тому підробка під менш популярний пакет як схожа назва не позначиться.
+- Імена коротші за 5 символів не порівнюються: там простір назв надто щільний,
+  щоб відстань редагування щось означала.
 - Кожна перевірка — це живий запит до реєстру. Кешування ще немає.
 
 ---

{ghostpkg-0.2.0 → ghostpkg-0.3.0}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.2.0 → ghostpkg-0.3.0}/ghostpkg/assess.py

@@ -18,7 +18,7 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from enum import Enum
 
-from .data import TOP_PYPI
+from .data import TOP_NPM, TOP_PYPI
 from .registries import PackageFacts
 
 YOUNG_DAYS = 90
@@ -45,25 +45,44 @@ class Finding:
 
 
 def edit_distance(left: str, right: str, cutoff: int = 3) -> int:
-    """Levenshtein distance, abandoning early once it exceeds `cutoff`."""
+    """Damerau-Levenshtein distance, abandoning early once it exceeds `cutoff`.
+
+    Swapping two adjacent characters counts as one edit, not two. That matters
+    here more than it looks: transposition is the commonest typosquat shape --
+    `recat` for `react`, `lodahs` for `lodash`, `webpakc` for `webpack`. Plain
+    Levenshtein scores all three as two edits, which put them outside the budget
+    for names of that length and let every one of them through.
+    """
     if left == right:
         return 0
     if abs(len(left) - len(right)) > cutoff:
         return cutoff + 1
 
+    before_previous: list[int] = []
     previous = list(range(len(right) + 1))
     for i, a in enumerate(left, 1):
         current = [i]
         for j, b in enumerate(right, 1):
-            current.append(
-                min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + (a != b))
-            )
+            cost = min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + (a != b))
+            if (
+                i > 1
+                and j > 1
+                and a == right[j - 2]
+                and left[i - 2] == b
+            ):
+                cost = min(cost, before_previous[j - 2] + 1)
+            current.append(cost)
         if min(current) > cutoff:
             return cutoff + 1
-        previous = current
+        before_previous, previous = previous, current
     return previous[-1]
 
 
+POPULAR: dict[str, frozenset[str]] = {"pypi": TOP_PYPI, "npm": TOP_NPM}
+
+MIN_COMPARABLE_LENGTH = 5
+
+
 def _typo_budget(name: str) -> int:
     """How many edits still count as a plausible typo of a popular name.
 
@@ -74,18 +93,40 @@ def _typo_budget(name: str) -> int:
     return 2 if len(name) >= 10 else 1
 
 
-def nearest_popular(name: str, popular: frozenset[str] = TOP_PYPI) -> tuple[str, int] | None:
+def _comparable(name: str, ecosystem: str) -> str:
+    """The part of a name worth comparing.
+
+    An npm squat on a scoped package targets the part after the slash, since
+    the scope is usually owned by whoever it names.
+    """
+    lowered = name.lower()
+    if ecosystem == "npm" and lowered.startswith("@") and "/" in lowered:
+        return lowered.rsplit("/", 1)[1]
+    return lowered
+
+
+def nearest_popular(name: str, ecosystem: str = "pypi") -> tuple[str, int] | None:
     """Closest popular package name within the typo budget, if any."""
+    popular = POPULAR.get(ecosystem)
+    if not popular:
+        return None
+
     lowered = name.lower()
-    if lowered in popular:
+    target = _comparable(name, ecosystem)
+
+    if lowered in popular or target in popular:
+        return None
+    # Below this length the name space is too dense for edit distance to mean
+    # anything: 'core' sits one edit from 'cors'.
+    if len(target) < MIN_COMPARABLE_LENGTH:
         return None
 
-    budget = _typo_budget(lowered)
+    budget = _typo_budget(target)
     best: tuple[str, int] | None = None
     for candidate in popular:
-        if abs(len(candidate) - len(lowered)) > budget:
+        if abs(len(candidate) - len(target)) > budget:
             continue
-        distance = edit_distance(lowered, candidate, cutoff=budget)
+        distance = edit_distance(target, candidate, cutoff=budget)
         if 0 < distance <= budget and (best is None or distance < best[1]):
             best = (candidate, distance)
             if distance == 1:
@@ -114,7 +155,7 @@ def assess(facts: PackageFacts, strict: bool = False) -> Finding:
     is_young = facts.age_days is not None and facts.age_days < NEW_DAYS
 
     if is_young:
-        neighbour = nearest_popular(facts.name)
+        neighbour = nearest_popular(facts.name, facts.ecosystem)
         if neighbour is not None:
             popular_name, distance = neighbour
             reasons.append(