ghostpkg 0.24.0__tar.gz → 0.24.2__tar.gz

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/.pre-commit-hooks.yaml

@@ -2,7 +2,7 @@
 #
 #   repos:
 #     - repo: https://github.com/M1rwana12/ghostpkg
-#       rev: v0.19.0
+#       rev: v0.24.0
 #       hooks:
 #         - id: ghostpkg
 #

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/CHANGELOG.md

@@ -6,6 +6,38 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.24.2] - 2026-09-04
+
+### Changed
+- The action is named **ghostpkg - hallucinated package check** in its
+  `action.yml`. The GitHub Marketplace requires a name unique across every
+  action, user and organisation on GitHub, and `ghostpkg` alone is taken by an
+  existing account. This is the display name in the Marketplace only -- the
+  repository, the PyPI package and `uses: M1rwana12/ghostpkg@v0.24.2` are all
+  unchanged.
+
+## [0.24.1] - 2026-09-04
+
+### Documentation
+Three claims that outlived the behaviour they described, found by re-reading
+both READMEs against a live run before publishing the Action.
+
+- **The cache paragraph still said "does not exist is held for only an hour"**
+  in both languages, and contradicted itself three hundred lines later with
+  "negatives are never cached". The second is true. The first described the
+  precise failure this tool exists to avoid, and an earlier patch had missed
+  the wording. It now also explains why the rule runs in both directions: a
+  free name can be registered at any moment, and a name published a moment ago
+  404s briefly because PyPI's feed announces it before the JSON API serves it.
+- `CONTRIBUTING.md` still described the popular-name list as PyPI-derived and
+  npm typo detection as weak because of it. There have been 2,000 names per
+  ecosystem for some time.
+- The usage comment in `.pre-commit-hooks.yaml` pinned `v0.19.0`.
+
+Verified live rather than by reading: every flag in `--help` appears in both
+options tables, the documented exit codes match, `--format github` emits the
+annotation exactly as shown, and the `--json` envelope matches its example.
+
 ## [0.24.0] - 2026-09-04
 
 The gate now runs in CI, and it scanned **88,904 packages across sixteen
@@ -983,7 +1015,9 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.24.0...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.24.2...HEAD
+[0.24.2]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.2
+[0.24.1]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.1
 [0.24.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.0
 [0.23.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.23.0
 [0.22.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.22.0

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/CONTRIBUTING.md

@@ -43,8 +43,9 @@ new blocking signal, bring evidence that it does not fire on legitimate packages
 - **The open problem:** detecting a hallucinated name that an attacker has
   *already registered*. The existence check cannot see it. If you have an idea
   that does not collapse into "block everything new", open an issue.
-- npm coverage. The popular-name list used for typo distance is PyPI-derived, so
-  npm typosquat detection is weaker than it should be.
+- Wider popular-name lists. There are 2,000 names per ecosystem now and each
+  name is compared against its own registry's list, so `recat`, `lodahs` and
+  `webpakc` are caught -- but a squat on anything outside the top 2,000 is not.
 - More ecosystems: crates.io, RubyGems, Go modules.
 
 ## Please don't

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.24.0
+Version: 0.24.2
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -278,9 +278,13 @@ Lookups are cached on disk, so re-scanning a 150-package manifest takes 0.4s
 instead of 4.7s.
 
 Time-to-live depends on the answer, and the negative case is the one that
-matters: **"does not exist" is held for only an hour**, because a free name can
-be registered at any moment and that is the entire attack. Young packages are
-held six hours, established ones a day.
+matters: **"does not exist" is never cached at all.** That answer is the only
+one that blocks, so it has to be fresh in both directions -- a free name can be
+registered at any moment, which is the entire attack, and a name published a
+moment ago can 404 briefly because PyPI's feed announces it before the JSON API
+serves it. Caching that for an hour produced a real false block on a live
+package. Young packages are held six hours, established ones a day, and a
+pinned version is re-checked against a fresh list before it is ever blocked.
 
 ```bash
 ghostpkg scan requirements.txt --no-cache   # bypass it

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/README.en.md

@@ -230,9 +230,13 @@ Lookups are cached on disk, so re-scanning a 150-package manifest takes 0.4s
 instead of 4.7s.
 
 Time-to-live depends on the answer, and the negative case is the one that
-matters: **"does not exist" is held for only an hour**, because a free name can
-be registered at any moment and that is the entire attack. Young packages are
-held six hours, established ones a day.
+matters: **"does not exist" is never cached at all.** That answer is the only
+one that blocks, so it has to be fresh in both directions -- a free name can be
+registered at any moment, which is the entire attack, and a name published a
+moment ago can 404 briefly because PyPI's feed announces it before the JSON API
+serves it. Caching that for an hour produced a real false block on a live
+package. Young packages are held six hours, established ones a day, and a
+pinned version is re-checked against a fresh list before it is ever blocked.
 
 ```bash
 ghostpkg scan requirements.txt --no-cache   # bypass it

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/README.md

@@ -91,10 +91,14 @@ ghostpkg check somepkg --json
 ghostpkg clear-cache
 ```
 
-Результати запитів кешуються на диск: повторна перевірка манифесту зі 150
-залежностей займає 0,4 с замість 4,7 с. **Відповідь «пакета не існує»
-зберігається лише годину** — вільне ім'я можуть зареєструвати будь-якої
-миті, і саме в цьому вся атака.
+Результати запитів кешуються на диск: повторна перевірка маніфесту зі 150
+залежностей займає 0,4 с замість 4,7 с. **Відповідь «пакета не існує» не
+кешується взагалі** — це єдина відповідь, яка блокує, тож вона має бути свіжою
+в обидва боки. Вільне ім'я можуть зареєструвати будь-якої миті, і саме в цьому
+вся атака; а щойно опублікований пакет якийсь час віддає 404, бо стрічка PyPI
+оголошує його раніше, ніж його починає віддавати JSON API. Кешування цієї
+відповіді на годину вже дало справжнє хибне блокування живого пакета.
+Закріплена версія теж перевіряється за свіжим списком, перш ніж заблокувати.
 
 | Прапорець | Призначення |
 |---|---|

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/action.yml

@@ -1,4 +1,8 @@
-name: ghostpkg
+# The Marketplace requires a name unique across every action, user and
+# organisation on GitHub, and `ghostpkg` is taken by an existing account. This
+# is the display name there only -- the repository, the PyPI package and
+# `uses: M1rwana12/ghostpkg@v...` are all unchanged.
+name: ghostpkg - hallucinated package check
 description: Catch package names that do not exist before you install them
 author: m1rwana12
 

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.24.0"
+__version__ = "0.24.2"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.24.0 → ghostpkg-0.24.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ghostpkg"
-version = "0.24.0"
+version = "0.24.2"
 description = "Catch package names that do not exist before you install them"
 readme = "README.en.md"  # English page for PyPI; the repo main page is Ukrainian
 requires-python = ">=3.9"