repovet-cli 0.1.0__py3-none-any.whl

repovet/__init__.py

@@ -0,0 +1,3 @@
+"""repovet: vet a GitHub repo before you trust it."""
+
+__version__ = "0.1.0"

repovet/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

repovet/checks.py

@@ -0,0 +1,372 @@
+"""Pure checks: take already-fetched GitHub data, return findings. No network here."""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from datetime import datetime
+
+POINTS = {"high": 25, "medium": 12, "low": 5, "info": 0}
+SEVERITY_ORDER = {"high": 0, "medium": 1, "low": 2, "info": 3}
+
+
+@dataclass
+class Finding:
+    severity: str  # high | medium | low | info
+    category: str  # stars | maintenance | people | license | install | identity
+    title: str
+    detail: str = ""
+
+    @property
+    def points(self) -> int:
+        return POINTS[self.severity]
+
+    def as_dict(self) -> dict:
+        return {"severity": self.severity, "category": self.category,
+                "title": self.title, "detail": self.detail}
+
+
+def parse_ts(value: str) -> datetime:
+    return datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+
+def days_between(start: datetime, end: datetime) -> float:
+    return (end - start).total_seconds() / 86400
+
+
+# --------------------------------------------------------------------------- stars
+def star_burst(star_pages: list[list[str]]) -> float | None:
+    """Ratio of the fastest sampled star page to the median one, if it looks like a spike."""
+    rates = []
+    for page in star_pages:
+        if len(page) < 50:
+            continue
+        stamps = sorted(parse_ts(s) for s in page)
+        span = max(days_between(stamps[0], stamps[-1]), 1 / 1440)
+        rates.append(len(stamps) / span)
+    if len(rates) < 3:
+        return None
+    ordered = sorted(rates)
+    median = ordered[len(ordered) // 2]
+    if median <= 0:
+        return None
+    ratio = ordered[-1] / median
+    return ratio if ratio >= 50 else None
+
+
+def is_ghost(profile: dict) -> bool:
+    """Stargazer account that was brand new when it starred, or has no footprint at all."""
+    try:
+        fresh = days_between(parse_ts(profile["created_at"]),
+                             parse_ts(profile["starred_at"])) < 14
+    except (KeyError, ValueError, TypeError):
+        fresh = False
+    empty = profile.get("followers", 1) == 0 and profile.get("public_repos", 1) == 0
+    return fresh or empty
+
+
+def check_stars(repo: dict, issue_total: int | None, star_pages: list[list[str]],
+                profiles: list[dict], now: datetime) -> list[Finding]:
+    out: list[Finding] = []
+    stars = repo.get("stargazers_count", 0)
+    forks = repo.get("forks_count", 0)
+    watchers = repo.get("subscribers_count")
+    age = max(days_between(parse_ts(repo["created_at"]), now), 1)
+
+    if stars >= 500:
+        ratio = forks / stars
+        detail = (f"{forks:,} forks vs {stars:,} stars ({ratio:.1%}). "
+                  "Real projects usually sit around 5-15%.")
+        if ratio < 0.01:
+            out.append(Finding("medium", "stars", "Almost nobody forks it", detail))
+        elif ratio < 0.03:
+            out.append(Finding("low", "stars", "Low fork-to-star ratio", detail))
+
+    if stars >= 2000 and watchers is not None and watchers / stars < 0.001:
+        out.append(Finding("low", "stars", "Almost nobody watches it",
+                           f"{watchers:,} watchers vs {stars:,} stars."))
+
+    if (stars >= 1000 and issue_total is not None and repo.get("has_issues", True)
+            and issue_total <= 3):
+        out.append(Finding(
+            "medium", "stars", "Stars without users",
+            f"{stars:,} stars but only {issue_total} issues/PRs ever opened. "
+            "Popular code that people really run collects bug reports."))
+
+    if age < 90 and stars / age > 1000:
+        out.append(Finding("info", "stars", "Explosive growth",
+                           f"~{stars / age:,.0f} stars/day since creation. "
+                           "Could be a real viral launch; verify before trusting."))
+
+    burst = star_burst(star_pages)
+    if burst:
+        out.append(Finding(
+            "low", "stars", "Star spike",
+            f"One sampled batch of stars arrived ~{burst:,.0f}x faster than the typical "
+            "pace. Can be an organic launch spike or a purchased batch."))
+
+    if len(profiles) >= 30:
+        share = sum(is_ghost(p) for p in profiles) / len(profiles)
+        detail = (f"{share:.0%} of the {len(profiles)} most recent stargazers are "
+                  "brand-new or empty accounts (no repos, no followers).")
+        if share >= 0.35:
+            out.append(Finding("high", "stars", "Stargazers look fake", detail))
+        elif share >= 0.18:
+            out.append(Finding("medium", "stars", "Many low-quality stargazers", detail))
+    return out
+
+
+# --------------------------------------------------------------------- maintenance
+def check_maintenance(repo: dict, commits: list[dict], now: datetime) -> list[Finding]:
+    out: list[Finding] = []
+    stars = repo.get("stargazers_count", 0)
+    if repo.get("disabled"):
+        out.append(Finding("high", "maintenance", "Repository is disabled", ""))
+    if repo.get("archived"):
+        out.append(Finding("high", "maintenance", "Archived (read-only)",
+                           "The owner has stopped maintaining it. No fixes will land."))
+    else:
+        idle = days_between(parse_ts(repo["pushed_at"]), now)
+        if idle > 730:
+            out.append(Finding("high", "maintenance", "Abandoned",
+                               f"No push in {idle / 365:.1f} years."))
+        elif idle > 365:
+            out.append(Finding("medium", "maintenance", "Stale",
+                               f"No push in {idle:.0f} days."))
+        elif idle > 180:
+            out.append(Finding("low", "maintenance", "Slowing down",
+                               f"No push in {idle:.0f} days."))
+
+    age = days_between(parse_ts(repo["created_at"]), now)
+    if age < 30:
+        out.append(Finding("low", "maintenance", "Very new project",
+                           f"Created {age:.0f} days ago. No track record yet."))
+
+    if commits and len(commits) < 5 and stars >= 500:
+        out.append(Finding("medium", "maintenance", "Barely any commits",
+                           f"Only {len(commits)} commits on the default branch for a "
+                           f"repo with {stars:,} stars."))
+    return out
+
+
+# -------------------------------------------------------------------------- people
+def top_author_share(commits: list[dict]) -> tuple[str | None, float]:
+    counts: dict[str, int] = {}
+    for commit in commits:
+        author = (commit.get("author") or {}).get("login") or (
+            ((commit.get("commit") or {}).get("author") or {}).get("name"))
+        if author:
+            counts[author] = counts.get(author, 0) + 1
+    if not counts:
+        return None, 0.0
+    name, top = max(counts.items(), key=lambda item: item[1])
+    return name, top / sum(counts.values())
+
+
+def check_people(repo: dict, owner: dict | None, contributors: list[dict],
+                 commits: list[dict], now: datetime) -> list[Finding]:
+    out: list[Finding] = []
+    stars = repo.get("stargazers_count", 0)
+    name, share = top_author_share(commits)
+    if len(commits) >= 20 and share >= 0.9 and len(contributors) <= 2:
+        out.append(Finding("low", "people", "Single maintainer",
+                           f"{name} wrote {share:.0%} of the recent commits. "
+                           "If they leave, the project stops."))
+    if owner and owner.get("type") == "User" and stars >= 1000:
+        owner_age = days_between(parse_ts(owner["created_at"]), now)
+        if owner_age < 90:
+            out.append(Finding("medium", "people", "Owner account is brand new",
+                               f"Account created {owner_age:.0f} days ago yet owns a "
+                               f"{stars:,}-star repo."))
+        elif owner.get("public_repos", 0) <= 2 and owner.get("followers", 0) < 20:
+            out.append(Finding("low", "people", "Owner has no track record",
+                               f"{owner.get('public_repos', 0)} public repos, "
+                               f"{owner.get('followers', 0)} followers."))
+    return out
+
+
+# ------------------------------------------------------------------------- license
+RESTRICTIVE = ("AGPL", "GPL", "SSPL", "BUSL", "CC-BY-NC", "Elastic")
+
+
+def check_license(repo: dict) -> list[Finding]:
+    lic = repo.get("license")
+    if not lic:
+        return [Finding("medium", "license", "No license",
+                        "Without a license you have no legal right to reuse or modify "
+                        "the code, even though it is public.")]
+    spdx = lic.get("spdx_id") or ""
+    if spdx in ("", "NOASSERTION"):
+        return [Finding("low", "license", "Custom or unrecognized license",
+                        "GitHub could not classify the license. Read it before using.")]
+    if any(spdx.startswith(prefix) or prefix in spdx for prefix in RESTRICTIVE):
+        return [Finding("info", "license", f"Restrictive license ({spdx})",
+                        "Copyleft or source-available terms. Check they fit your use.")]
+    return []
+
+
+# ------------------------------------------------------------------------- install
+EXEC_EXT = (".exe", ".scr", ".msi", ".lnk")
+LIB_EXT = (".dll", ".so", ".dylib", ".jar", ".bin", ".pyc")
+INSTALL_NAMES = ("install.sh", "setup.sh", "install.ps1", "setup.ps1", "install.bat",
+                 "bootstrap.sh")
+
+SCRIPT_PATTERNS = [
+    ("high", r"(eval|exec)\s*\(.{0,80}(b64decode|atob|fromCharCode|decompress)",
+     "Runs obfuscated/decoded code"),
+    ("high", r"powershell[^\n]{0,60}\s-e(nc|ncodedcommand)?\s+[A-Za-z0-9+/=]{20,}",
+     "Runs an encoded PowerShell command"),
+    ("high", r"(IEX|Invoke-Expression)[^\n]{0,80}(DownloadString|Invoke-WebRequest|iwr|irm)",
+     "Downloads and executes remote PowerShell"),
+    ("high", r"discord(app)?\.com/api/webhooks/|api\.telegram\.org/bot",
+     "Sends data to a Discord/Telegram webhook"),
+    ("medium", r"(curl|wget)[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z)?sh\b",
+     "Pipes a remote script straight into a shell"),
+    ("medium", r"https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[:/]",
+     "Talks to a hard-coded IP address"),
+    ("medium", r"base64\s+(-d|--decode)[^\n]{0,40}\|\s*(ba|z)?sh",
+     "Decodes base64 and runs it"),
+]
+README_PATTERNS = [
+    ("medium", r"(\.zip|\.rar|\.7z|archive)[^\n]{0,200}pass(word)?\s*[:=`* ]+\S+"
+               r"|pass(word)?\s*[:=`* ]+\S+[^\n]{0,200}(\.zip|\.rar|\.7z)",
+     "README tells you to open a password-protected archive",
+     "Classic malware delivery: the password hides the payload from scanners."),
+    ("low", r"(curl|wget)[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z)?sh\b",
+     "README install pipes a remote script into a shell",
+     "Common, but read the script before running it."),
+]
+SETUP_PY_RISK = re.compile(r"\b(os\.system|subprocess\.|urllib\.request|requests\.(get|post)"
+                           r"|socket\.)")
+HOOK_RISK = re.compile(r"curl|wget|node\s+-e|powershell|base64|https?://", re.I)
+
+
+def pick_files(tree_paths: list[str]) -> list[str]:
+    """Which files are worth downloading for the install-risk check."""
+    wanted: list[str] = []
+    for path in tree_paths:
+        lower = path.lower()
+        base = lower.rsplit("/", 1)[-1]
+        depth = lower.count("/")
+        if depth == 0 and (base.startswith("readme") or base in ("package.json", "setup.py")):
+            wanted.append(path)
+        elif depth <= 1 and base in INSTALL_NAMES:
+            wanted.append(path)
+    return wanted[:8]
+
+
+def check_install(tree_paths: list[str], files: dict[str, str]) -> list[Finding]:
+    out: list[Finding] = []
+
+    executables = [p for p in tree_paths if p.lower().endswith(EXEC_EXT)]
+    libraries = [p for p in tree_paths if p.lower().endswith(LIB_EXT)]
+    if executables:
+        out.append(Finding("medium", "install", "Executables committed to the repo",
+                           f"{len(executables)} file(s), e.g. {executables[0]}. "
+                           "You cannot review what a binary does."))
+    elif libraries:
+        out.append(Finding("low", "install", "Prebuilt binaries committed",
+                           f"{len(libraries)} file(s), e.g. {libraries[0]}."))
+
+    for path, text in files.items():
+        base = path.lower().rsplit("/", 1)[-1]
+        if base.startswith("readme"):
+            for severity, pattern, title, detail in README_PATTERNS:
+                if re.search(pattern, text, re.I):
+                    out.append(Finding(severity, "install", title, detail))
+            continue
+
+        if base == "package.json":
+            try:
+                scripts = (json.loads(text).get("scripts") or {})
+            except (ValueError, AttributeError):
+                scripts = {}
+            for hook in ("preinstall", "install", "postinstall"):
+                command = scripts.get(hook)
+                if isinstance(command, str) and command.strip():
+                    risky = HOOK_RISK.search(command)
+                    out.append(Finding(
+                        "medium" if risky else "low", "install",
+                        f"npm {hook} hook runs on install",
+                        f"`{command[:140]}`"))
+        if base == "setup.py" and SETUP_PY_RISK.search(text):
+            out.append(Finding("medium", "install",
+                               "setup.py runs commands or network calls",
+                               "Code executes on `pip install`, before you ever import it."))
+        for severity, pattern, title in SCRIPT_PATTERNS:
+            if re.search(pattern, text, re.I):
+                out.append(Finding(severity, "install", title, f"in {path}"))
+    return out
+
+
+# ------------------------------------------------------------------------ identity
+def norm_name(name: str) -> str:
+    return re.sub(r"[^a-z0-9]", "", name.lower())
+
+
+def jaccard(a: str | None, b: str | None) -> float:
+    words_a = set(re.findall(r"[a-z0-9]{3,}", (a or "").lower()))
+    words_b = set(re.findall(r"[a-z0-9]{3,}", (b or "").lower()))
+    if not words_a or not words_b:
+        return 0.0
+    return len(words_a & words_b) / len(words_a | words_b)
+
+
+def check_identity(repo: dict, name_hits: list[dict]) -> list[Finding]:
+    out: list[Finding] = []
+    if repo.get("fork") and repo.get("parent"):
+        out.append(Finding("info", "identity",
+                           f"Fork of {repo['parent'].get('full_name')}",
+                           "Check whether you want the original instead."))
+    name = norm_name(repo["name"])
+    if len(name) < 4:
+        return out
+    me = repo["full_name"].lower()
+    stars = repo.get("stargazers_count", 0)
+    created = parse_ts(repo["created_at"])
+    same = [h for h in name_hits
+            if h["full_name"].lower() != me and norm_name(h["name"]) == name]
+
+    originals = [h for h in same
+                 if h.get("stargazers_count", 0) > max(2 * stars, 50)
+                 and parse_ts(h["created_at"]) < created]
+    if originals:
+        top = max(originals, key=lambda h: h.get("stargazers_count", 0))
+        similar = jaccard(repo.get("description"), top.get("description")) >= 0.4
+        out.append(Finding(
+            "medium" if similar else "low", "identity",
+            "Same name as a bigger, older repo",
+            f"{top['full_name']} ({top.get('stargazers_count', 0):,} stars) predates "
+            "this one" + (" and has a near-identical description." if similar else ".")
+            + " Make sure this is the project you meant."))
+    else:
+        copies = [h for h in same if parse_ts(h["created_at"]) > created
+                  and jaccard(repo.get("description"), h.get("description")) >= 0.4]
+        if copies:
+            out.append(Finding("info", "identity", f"{len(copies)} lookalike repo(s) exist",
+                               "Others copy this name and description, e.g. "
+                               f"{copies[0]['full_name']}. This one is the older repo."))
+    return out
+
+
+def alternatives(repo: dict, topic_hits: list[dict], limit: int = 5) -> list[dict]:
+    me = repo["full_name"].lower()
+    # Tiny repos that merely share a topic are noise, not alternatives.
+    floor = max(50, repo.get("stargazers_count", 0) // 100)
+    picked = [h for h in topic_hits if h["full_name"].lower() != me and not h.get("archived")
+              and h.get("stargazers_count", 0) >= floor]
+    picked.sort(key=lambda h: h.get("stargazers_count", 0), reverse=True)
+    return [{"full_name": h["full_name"], "stars": h.get("stargazers_count", 0),
+             "description": (h.get("description") or "")[:90]} for h in picked[:limit]]
+
+
+# ------------------------------------------------------------------------- scoring
+def score(findings: list[Finding]) -> tuple[int, str]:
+    value = max(0, 100 - sum(f.points for f in findings))
+    has_high = any(f.severity == "high" for f in findings)
+    if value >= 80 and not has_high:
+        return value, "LOOKS OK"
+    if value >= 55:
+        return value, "CAUTION"
+    return value, "HIGH RISK"

repovet/cli.py

@@ -0,0 +1,104 @@
+"""Command line entry point."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+from . import __version__
+from .github import GitHub, GitHubError, NotFound, RateLimited, find_token
+from .radar import detect_stack, radar
+from .render import render_radar, render_vet
+from .vet import vet
+
+
+def parse_target(target: str) -> tuple[str, str]:
+    cleaned = target.strip()
+    cleaned = re.sub(r"^(https?://)?(www\.)?github\.com/", "", cleaned, flags=re.I)
+    cleaned = re.sub(r"^git@github\.com:", "", cleaned, flags=re.I)
+    parts = [p for p in cleaned.split("/") if p]
+    if len(parts) < 2:
+        raise ValueError(f"expected owner/repo or a GitHub URL, got: {target}")
+    owner, name = parts[0], parts[1]
+    if name.endswith(".git"):
+        name = name[:-4]
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+", owner) or not re.fullmatch(r"[A-Za-z0-9_.-]+", name):
+        raise ValueError(f"not a valid repo reference: {target}")
+    return owner, name
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="repovet",
+        description="Vet a GitHub repo before you trust it, and find new repos for your stack.")
+    parser.add_argument("--version", action="version", version=f"repovet {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    def common(p: argparse.ArgumentParser):
+        p.add_argument("--json", action="store_true", help="machine-readable output")
+        p.add_argument("--no-cache", action="store_true",
+                       help="ignore the 1-hour response cache")
+
+    p_vet = sub.add_parser("vet", help="score one repo for trust signals")
+    p_vet.add_argument("repo", help="owner/repo or GitHub URL")
+    p_vet.add_argument("--fail-under", type=int, metavar="N",
+                       help="exit with code 2 if the score is below N (for CI)")
+    common(p_vet)
+
+    p_radar = sub.add_parser("radar", help="new repos matching your stack")
+    p_radar.add_argument("--path", default=".", help="project folder to read the stack from")
+    p_radar.add_argument("--lang", action="append", default=[],
+                         help="language to follow (repeatable); overrides detection")
+    p_radar.add_argument("--topic", action="append", default=[],
+                         help="GitHub topic to follow (repeatable)")
+    p_radar.add_argument("--days", type=int, default=14, help="how far back to look")
+    p_radar.add_argument("--min-stars", type=int, default=100)
+    p_radar.add_argument("--top", type=int, default=15, help="how many results to show")
+    common(p_radar)
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")
+        except (AttributeError, ValueError):
+            pass
+    args = build_parser().parse_args(argv)
+    gh = GitHub(token=find_token(), cache_ttl=0 if args.no_cache else 3600)
+
+    try:
+        if args.command == "vet":
+            owner, name = parse_target(args.repo)
+            report = vet(gh, owner, name)
+            print(json.dumps(report, indent=2) if args.json else render_vet(report))
+            if args.fail_under is not None and report["score"] < args.fail_under:
+                return 2
+            return 0
+
+        languages, topics = list(args.lang), list(args.topic)
+        if not languages and not topics:
+            languages, topics = detect_stack(Path(args.path))
+        report = radar(gh, languages, topics, days=args.days,
+                       min_stars=args.min_stars, top=args.top)
+        print(json.dumps(report, indent=2) if args.json else render_radar(report))
+        return 0
+    except ValueError as err:
+        print(f"error: {err}", file=sys.stderr)
+        return 1
+    except NotFound:
+        print("error: repository not found (private, renamed, or misspelled)", file=sys.stderr)
+        return 1
+    except RateLimited as err:
+        print(f"error: {err}. Set GITHUB_TOKEN to raise the limit.", file=sys.stderr)
+        return 1
+    except GitHubError as err:
+        print(f"error: {err}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

repovet/github.py

@@ -0,0 +1,159 @@
+"""Minimal GitHub API client: stdlib only, on-disk cache, clear rate-limit errors."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import subprocess
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+API = "https://api.github.com"
+RAW = "https://raw.githubusercontent.com"
+USER_AGENT = "repovet-cli"
+MAX_RAW_BYTES = 200_000
+
+
+class GitHubError(Exception):
+    pass
+
+
+class NotFound(GitHubError):
+    pass
+
+
+class RateLimited(GitHubError):
+    def __init__(self, reset_epoch: int | None = None):
+        self.reset_epoch = reset_epoch
+        wait = ""
+        if reset_epoch:
+            mins = max(0, int((reset_epoch - time.time()) / 60) + 1)
+            wait = f" (resets in ~{mins} min)"
+        super().__init__(f"GitHub API rate limit hit{wait}")
+
+
+def find_token() -> str | None:
+    """Token from GITHUB_TOKEN / GH_TOKEN, else from the gh CLI if it is logged in."""
+    for key in ("GITHUB_TOKEN", "GH_TOKEN"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            return value
+    try:
+        out = subprocess.run(
+            ["gh", "auth", "token"], capture_output=True, text=True, timeout=5
+        )
+        if out.returncode == 0 and out.stdout.strip():
+            return out.stdout.strip()
+    except (OSError, subprocess.SubprocessError):
+        pass
+    return None
+
+
+class GitHub:
+    def __init__(self, token: str | None = None, cache_ttl: int = 3600,
+                 cache_dir: Path | None = None):
+        self.token = token
+        self.cache_ttl = cache_ttl
+        self.cache_dir = cache_dir or Path(
+            os.environ.get("REPOVET_CACHE") or Path.home() / ".cache" / "repovet"
+        )
+        self.requests_made = 0
+
+    # -- cache ---------------------------------------------------------------
+    def _cache_path(self, key: str) -> Path:
+        return self.cache_dir / (hashlib.sha256(key.encode()).hexdigest() + ".json")
+
+    def _cache_get(self, key: str):
+        if self.cache_ttl <= 0:
+            return None
+        path = self._cache_path(key)
+        try:
+            if time.time() - path.stat().st_mtime > self.cache_ttl:
+                return None
+            return json.loads(path.read_text(encoding="utf-8"))["body"]
+        except (OSError, ValueError, KeyError):
+            return None
+
+    def _cache_put(self, key: str, body) -> None:
+        if self.cache_ttl <= 0:
+            return
+        try:
+            self.cache_dir.mkdir(parents=True, exist_ok=True)
+            self._cache_path(key).write_text(json.dumps({"body": body}), encoding="utf-8")
+        except OSError:
+            pass
+
+    # -- http ----------------------------------------------------------------
+    def _open(self, url: str, headers: dict, data: bytes | None = None) -> bytes:
+        headers = {"User-Agent": USER_AGENT, **headers}
+        req = urllib.request.Request(url, data=data, headers=headers)
+        self.requests_made += 1
+        try:
+            with urllib.request.urlopen(req, timeout=25) as resp:
+                return resp.read()
+        except urllib.error.HTTPError as err:
+            body = err.read().decode("utf-8", "replace")[:500]
+            if err.code == 404:
+                raise NotFound(f"not found: {url}") from None
+            if err.code in (403, 429) and (
+                err.headers.get("x-ratelimit-remaining") == "0"
+                or "rate limit" in body.lower()
+            ):
+                reset = err.headers.get("x-ratelimit-reset")
+                raise RateLimited(int(reset) if reset and reset.isdigit() else None) from None
+            raise GitHubError(f"HTTP {err.code} for {url}: {body[:160]}") from None
+        except (urllib.error.URLError, TimeoutError, OSError) as err:
+            raise GitHubError(f"network error for {url}: {err}") from None
+
+    def _auth(self) -> dict:
+        return {"Authorization": f"Bearer {self.token}"} if self.token else {}
+
+    def get(self, path: str, params: dict | None = None,
+            accept: str = "application/vnd.github+json"):
+        url = API + path
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+        key = f"{accept}|{url}"
+        cached = self._cache_get(key)
+        if cached is not None:
+            return cached
+        raw = self._open(url, {"Accept": accept, **self._auth()})
+        body = json.loads(raw.decode("utf-8")) if raw else None
+        if body is not None:
+            self._cache_put(key, body)
+        return body
+
+    def graphql(self, query: str, variables: dict):
+        if not self.token:
+            raise GitHubError("GraphQL needs a token")
+        key = "graphql|" + query + json.dumps(variables, sort_keys=True)
+        cached = self._cache_get(key)
+        if cached is not None:
+            return cached
+        payload = json.dumps({"query": query, "variables": variables}).encode()
+        raw = self._open(API + "/graphql",
+                         {"Content-Type": "application/json", **self._auth()}, payload)
+        body = json.loads(raw.decode("utf-8"))
+        if body.get("errors"):
+            raise GitHubError("GraphQL: " + str(body["errors"][0].get("message")))
+        self._cache_put(key, body["data"])
+        return body["data"]
+
+    def raw(self, full_name: str, ref: str, path: str) -> str | None:
+        """Fetch a file from raw.githubusercontent.com (not counted against the API limit)."""
+        url = f"{RAW}/{full_name}/{urllib.parse.quote(ref)}/{urllib.parse.quote(path)}"
+        key = "raw|" + url
+        cached = self._cache_get(key)
+        if cached is not None:
+            return cached
+        try:
+            data = self._open(url, {})
+        except GitHubError:
+            return None
+        text = data[:MAX_RAW_BYTES].decode("utf-8", "replace")
+        self._cache_put(key, text)
+        return text

repovet/radar.py

@@ -0,0 +1,139 @@
+"""Radar: new repos that match your stack, clones collapsed, ranked by real traction."""
+
+from __future__ import annotations
+
+import json
+import re
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+from . import checks
+from .github import GitHub, GitHubError
+
+# dependency name -> GitHub topic worth searching
+DEP_TOPICS = {
+    "react": "react", "next": "nextjs", "vue": "vue", "svelte": "svelte",
+    "express": "express", "tailwindcss": "tailwindcss", "electron": "electron",
+    "vite": "vite", "astro": "astro", "three": "threejs", "@anthropic-ai/sdk": "claude",
+    "openai": "openai", "langchain": "langchain", "django": "django", "fastapi": "fastapi",
+    "flask": "flask", "torch": "pytorch", "pandas": "pandas", "numpy": "numpy",
+    "anthropic": "claude", "transformers": "transformers", "playwright": "playwright",
+    "tokio": "tokio", "axum": "axum", "tauri": "tauri", "bevy": "bevy",
+}
+
+
+def detect_stack(path: Path) -> tuple[list[str], list[str]]:
+    """Guess languages and topics from manifest files in a project folder."""
+    languages: list[str] = []
+    deps: list[str] = []
+
+    def add_lang(lang: str):
+        if lang not in languages:
+            languages.append(lang)
+
+    package = path / "package.json"
+    if package.is_file():
+        try:
+            manifest = json.loads(package.read_text(encoding="utf-8", errors="replace"))
+            names = list((manifest.get("dependencies") or {})) + list(
+                (manifest.get("devDependencies") or {}))
+        except (ValueError, OSError, AttributeError):
+            names = []
+        add_lang("TypeScript" if "typescript" in names or (path / "tsconfig.json").is_file()
+                 else "JavaScript")
+        deps += names
+
+    for filename in ("requirements.txt", "pyproject.toml"):
+        manifest_path = path / filename
+        if manifest_path.is_file():
+            add_lang("Python")
+            try:
+                text = manifest_path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                text = ""
+            deps += re.findall(r"^[\s\"']*([A-Za-z0-9_.-]+)\s*(?:[=<>~!\[\"',]|$)", text, re.M)
+
+    for filename, lang in (("go.mod", "Go"), ("Cargo.toml", "Rust"), ("pom.xml", "Java"),
+                           ("build.gradle", "Java"), ("build.gradle.kts", "Kotlin"),
+                           ("Gemfile", "Ruby"), ("composer.json", "PHP")):
+        manifest_path = path / filename
+        if manifest_path.is_file():
+            add_lang(lang)
+            if filename == "Cargo.toml":
+                try:
+                    deps += re.findall(r"^([A-Za-z0-9_-]+)\s*=",
+                                       manifest_path.read_text(encoding="utf-8",
+                                                               errors="replace"), re.M)
+                except OSError:
+                    pass
+    if any(path.glob("*.csproj")) or any(path.glob("*.sln")):
+        add_lang("C#")
+
+    topics: list[str] = []
+    for dep in deps:
+        topic = DEP_TOPICS.get(dep.lower())
+        if topic and topic not in topics:
+            topics.append(topic)
+    return languages, topics
+
+
+def rank(items: list[dict], now: datetime) -> list[dict]:
+    """Collapse same-name clones, then order by age-adjusted traction."""
+    groups: dict[str, list[dict]] = {}
+    for item in {i["full_name"]: i for i in items}.values():
+        groups.setdefault(checks.norm_name(item["name"]), []).append(item)
+
+    rows = []
+    for group in groups.values():
+        group.sort(key=lambda i: (-i.get("stargazers_count", 0), i["created_at"]))
+        best = group[0]
+        stars = best.get("stargazers_count", 0)
+        forks = best.get("forks_count", 0)
+        age = max(checks.days_between(checks.parse_ts(best["created_at"]), now), 1)
+        per_day = stars / age
+        flags = []
+        quality = 1.0
+        if stars >= 500 and forks / stars < 0.01:
+            flags.append("few forks")
+            quality *= 0.4
+        if not best.get("description"):
+            flags.append("no description")
+            quality *= 0.7
+        if not best.get("license"):
+            flags.append("no license")
+            quality *= 0.85
+        if len(group) > 1:
+            flags.append(f"+{len(group) - 1} same-name clone(s) hidden")
+        rows.append({
+            "full_name": best["full_name"], "stars": stars, "forks": forks,
+            "age_days": round(age), "stars_per_day": round(per_day, 1),
+            "language": best.get("language"), "description": best.get("description") or "",
+            "flags": flags, "rank_score": round(per_day * quality, 2),
+            "url": best.get("html_url"),
+        })
+    rows.sort(key=lambda r: r["rank_score"], reverse=True)
+    return rows
+
+
+def radar(gh: GitHub, languages: list[str], topics: list[str], days: int = 14,
+          min_stars: int = 100, top: int = 15) -> dict:
+    now = datetime.now(timezone.utc)
+    since = (now - timedelta(days=days)).strftime("%Y-%m-%d")
+    base = f"created:>={since} stars:>={min_stars}"
+    queries = [f"{base} language:\"{lang}\"" for lang in languages[:3]]
+    queries += [f"{base} topic:{topic}" for topic in topics[:3]]
+    if not queries:
+        queries = [base]
+
+    items: list[dict] = []
+    errors: list[str] = []
+    for query in queries:
+        try:
+            result = gh.get("/search/repositories",
+                            {"q": query, "sort": "stars", "order": "desc", "per_page": 50})
+            items += (result or {}).get("items", [])
+        except GitHubError as err:
+            errors.append(str(err))
+            break
+    return {"since": since, "languages": languages[:3], "topics": topics[:3],
+            "queries": queries, "results": rank(items, now)[:top], "errors": errors}

repovet/render.py

@@ -0,0 +1,116 @@
+"""Terminal output."""
+
+from __future__ import annotations
+
+import os
+import sys
+
+COLORS = {"red": "31", "yellow": "33", "green": "32", "cyan": "36", "dim": "2", "bold": "1"}
+SEVERITY_COLOR = {"high": "red", "medium": "yellow", "low": "cyan", "info": "dim"}
+VERDICT_COLOR = {"LOOKS OK": "green", "CAUTION": "yellow", "HIGH RISK": "red"}
+
+
+def use_color() -> bool:
+    return sys.stdout.isatty() and not os.environ.get("NO_COLOR")
+
+
+def paint(text: str, color: str, enabled: bool) -> str:
+    return f"\033[{COLORS[color]}m{text}\033[0m" if enabled else text
+
+
+def human(number) -> str:
+    if number is None:
+        return "?"
+    if number >= 1_000_000:
+        return f"{number / 1_000_000:.1f}M"
+    if number >= 10_000:
+        return f"{number / 1000:.0f}k"
+    if number >= 1000:
+        return f"{number / 1000:.1f}k"
+    return str(number)
+
+
+def render_vet(report: dict) -> str:
+    color = use_color()
+    lines = []
+    verdict = report["verdict"]
+    lines.append(paint(report["repo"], "bold", color) + "  " + (report.get("url") or ""))
+    if report.get("description"):
+        lines.append(paint(report["description"][:110], "dim", color))
+    filled = round(report["score"] / 5)
+    bar = "#" * filled + "-" * (20 - filled)
+    lines.append("")
+    lines.append(paint(f"{verdict}  {report['score']}/100  [{bar}]",
+                       VERDICT_COLOR[verdict], color))
+    lines.append("")
+
+    findings = report["findings"]
+    if findings:
+        for finding in findings:
+            tag = paint(f"[{finding['severity'].upper():<6}]",
+                        SEVERITY_COLOR[finding["severity"]], color)
+            lines.append(f"{tag} {finding['title']}")
+            if finding["detail"]:
+                lines.append(f"         {paint(finding['detail'], 'dim', color)}")
+    else:
+        lines.append(paint("No red flags found.", "green", color))
+
+    facts = report["facts"]
+    lines.append("")
+    lines.append(paint("Facts", "bold", color))
+    rows = [
+        ("stars / forks / watchers",
+         f"{human(facts['stars'])} / {human(facts['forks'])} / {human(facts['watchers'])}"),
+        ("issues + PRs ever", human(facts["issues_and_prs_ever"])),
+        ("age / last push", f"{facts['age_days']}d / {facts['days_since_push']}d ago"),
+        ("license", facts["license"] or "none"),
+        ("language", facts["language"] or "?"),
+        ("contributors", facts["contributors"]),
+        ("top author", facts["top_author"] or "?"),
+        ("latest release", facts["latest_release"] or "none"),
+        ("owner", facts["owner"]),
+    ]
+    for label, value in rows:
+        lines.append(f"  {label:<26} {value}")
+
+    if report["alternatives"]:
+        lines.append("")
+        lines.append(paint("Similar repos (same topics)", "bold", color))
+        for alt in report["alternatives"]:
+            lines.append(f"  {human(alt['stars']):>6}  {alt['full_name']}  "
+                         + paint(alt["description"], "dim", color))
+
+    notes = list(report["errors"])
+    if not report["authenticated"]:
+        notes.append("No GitHub token: stargazer checks (fake accounts, star spikes) skipped "
+                     "and the API allows only ~6 vets/hour. Set GITHUB_TOKEN for full results.")
+    if notes:
+        lines.append("")
+        for note in notes:
+            lines.append(paint(f"note: {note}", "yellow", color))
+    lines.append("")
+    lines.append(paint("Heuristics, not proof. A flag is a reason to look closer.",
+                       "dim", color))
+    return "\n".join(lines)
+
+
+def render_radar(report: dict) -> str:
+    color = use_color()
+    scope = ", ".join(report["languages"] + report["topics"]) or "all languages"
+    lines = [paint(f"New repos since {report['since']}  ({scope})", "bold", color), ""]
+    if not report["results"]:
+        lines.append("Nothing matched. Try --days 30 or --min-stars 20.")
+    for index, row in enumerate(report["results"], 1):
+        head = (f"{index:>2}. {paint(row['full_name'], 'bold', color)}  "
+                f"{human(row['stars'])} stars  {row['age_days']}d old  "
+                f"~{row['stars_per_day']:,.0f}/day  {row['language'] or ''}")
+        lines.append(head)
+        if row["description"]:
+            lines.append(f"    {paint(row['description'][:100], 'dim', color)}")
+        if row["flags"]:
+            lines.append(f"    {paint('! ' + '; '.join(row['flags']), 'yellow', color)}")
+    for error in report["errors"]:
+        lines.append(paint(f"note: {error}", "yellow", color))
+    lines.append("")
+    lines.append(paint("Check any of them with: repovet vet owner/name", "dim", color))
+    return "\n".join(lines)

repovet/vet.py

@@ -0,0 +1,175 @@
+"""Fetch everything needed to vet one repo, then run the checks."""
+
+from __future__ import annotations
+
+import math
+from datetime import datetime, timezone
+
+from . import checks
+from .github import GitHub, GitHubError, NotFound, RateLimited
+
+STAR_JSON = "application/vnd.github.star+json"
+STARGAZER_QUERY = """
+query($owner: String!, $name: String!) {
+  repository(owner: $owner, name: $name) {
+    stargazers(last: 100) {
+      edges {
+        starredAt
+        node { createdAt followers { totalCount } repositories(privacy: PUBLIC) { totalCount } }
+      }
+    }
+  }
+}
+"""
+
+
+def _star_page_numbers(stars: int, samples: int) -> list[int]:
+    pages = min(math.ceil(stars / 100), 400)  # GitHub caps stargazer pagination
+    if pages <= 0:
+        return []
+    if pages <= samples:
+        return list(range(1, pages + 1))
+    step = (pages - 1) / (samples - 1)
+    return sorted({round(1 + i * step) for i in range(samples)})
+
+
+def collect(gh: GitHub, owner: str, name: str) -> dict:
+    """Download all inputs. Only the first call may raise; the rest degrade gracefully."""
+    data: dict = {"errors": []}
+    repo = gh.get(f"/repos/{owner}/{name}")
+    data["repo"] = repo
+    full = repo["full_name"]
+    limited = False
+
+    def safe(key: str, default, fetch):
+        nonlocal limited
+        if limited:
+            data[key] = default
+            return
+        try:
+            value = fetch()
+            data[key] = default if value is None else value
+        except RateLimited as err:
+            limited = True
+            data[key] = default
+            data["errors"].append(str(err) + "; later checks skipped")
+        except GitHubError as err:
+            data[key] = default
+            data["errors"].append(f"{key}: {err}")
+
+    safe("owner", None, lambda: gh.get(f"/users/{repo['owner']['login']}"))
+    safe("commits", [], lambda: gh.get(f"/repos/{full}/commits", {"per_page": 100}))
+    safe("contributors", [], lambda: gh.get(f"/repos/{full}/contributors", {"per_page": 100}))
+    safe("releases", [], lambda: gh.get(f"/repos/{full}/releases", {"per_page": 3}))
+    safe("last_issue", [], lambda: gh.get(f"/repos/{full}/issues",
+                                          {"state": "all", "per_page": 1}))
+    safe("tree", {}, lambda: gh.get(f"/repos/{full}/git/trees/{repo['default_branch']}",
+                                    {"recursive": 1}))
+
+    def star_pages():
+        if not gh.token:  # GitHub refuses anonymous stargazer listing
+            return []
+        pages = []
+        for number in _star_page_numbers(repo.get("stargazers_count", 0), 5):
+            try:
+                page = gh.get(f"/repos/{full}/stargazers",
+                              {"per_page": 100, "page": number}, accept=STAR_JSON) or []
+            except NotFound:
+                raise GitHubError("GitHub did not return the stargazer list for this token; "
+                                  "star-spike check skipped") from None
+            pages.append([s["starred_at"] for s in page if s.get("starred_at")])
+        return pages
+    safe("star_pages", [], star_pages)
+
+    def profiles():
+        if not gh.token:
+            return []
+        result = gh.graphql(STARGAZER_QUERY, {"owner": owner, "name": name})
+        edges = ((result.get("repository") or {}).get("stargazers") or {}).get("edges") or []
+        found = [{"starred_at": e["starredAt"], "created_at": e["node"]["createdAt"],
+                  "followers": e["node"]["followers"]["totalCount"],
+                  "public_repos": e["node"]["repositories"]["totalCount"]}
+                 for e in edges if e.get("node")]
+        if not found and repo.get("stargazers_count", 0) >= 30:
+            raise GitHubError("GitHub returned no stargazer profiles for this token; "
+                              "ghost-account check skipped")
+        return found
+    safe("profiles", [], profiles)
+
+    safe("name_hits", [], lambda: (gh.get("/search/repositories", {
+        "q": f"{repo['name']} in:name", "sort": "stars", "per_page": 30}) or {}).get("items", []))
+
+    topics = repo.get("topics") or []
+    if topics:
+        query = " ".join(f"topic:{t}" for t in topics[:2])
+        safe("topic_hits", [], lambda: (gh.get("/search/repositories", {
+            "q": query, "sort": "stars", "per_page": 10}) or {}).get("items", []))
+    else:
+        data["topic_hits"] = []
+
+    tree_paths = [item["path"] for item in (data["tree"].get("tree") or [])
+                  if item.get("type") == "blob"]
+    data["tree_paths"] = tree_paths
+    data["files"] = {}
+    for path in checks.pick_files(tree_paths):
+        text = gh.raw(full, repo["default_branch"], path)
+        if text:
+            data["files"][path] = text
+    return data
+
+
+def analyze(data: dict, authenticated: bool, now: datetime | None = None) -> dict:
+    now = now or datetime.now(timezone.utc)
+    repo = data["repo"]
+    last_issue = data.get("last_issue") or []
+    issue_total = last_issue[0].get("number") if last_issue else (
+        0 if "last_issue" in data and not data["errors"] else None)
+
+    findings = (
+        checks.check_stars(repo, issue_total, data.get("star_pages", []),
+                           data.get("profiles", []), now)
+        + checks.check_maintenance(repo, data.get("commits", []), now)
+        + checks.check_people(repo, data.get("owner"), data.get("contributors", []),
+                              data.get("commits", []), now)
+        + checks.check_license(repo)
+        + checks.check_install(data.get("tree_paths", []), data.get("files", {}))
+        + checks.check_identity(repo, data.get("name_hits", []))
+    )
+    findings.sort(key=lambda f: checks.SEVERITY_ORDER[f.severity])
+    value, verdict = checks.score(findings)
+
+    owner = data.get("owner") or {}
+    contributors = data.get("contributors", [])
+    releases = data.get("releases", [])
+    author, share = checks.top_author_share(data.get("commits", []))
+    facts = {
+        "stars": repo.get("stargazers_count", 0),
+        "forks": repo.get("forks_count", 0),
+        "watchers": repo.get("subscribers_count"),
+        "issues_and_prs_ever": issue_total,
+        "age_days": round(checks.days_between(checks.parse_ts(repo["created_at"]), now)),
+        "days_since_push": round(checks.days_between(checks.parse_ts(repo["pushed_at"]), now)),
+        "license": (repo.get("license") or {}).get("spdx_id"),
+        "language": repo.get("language"),
+        "contributors": f"{len(contributors)}+" if len(contributors) >= 100 else len(contributors),
+        "top_author": f"{author} ({share:.0%} of recent commits)" if author else None,
+        "latest_release": releases[0].get("tag_name") if releases else None,
+        "owner": f"{repo['owner']['login']} ({owner.get('type', repo['owner'].get('type'))})",
+        "stargazer_profiles_sampled": len(data.get("profiles", [])),
+    }
+    return {
+        "repo": repo["full_name"],
+        "url": repo.get("html_url"),
+        "description": repo.get("description"),
+        "score": value,
+        "verdict": verdict,
+        "findings": [f.as_dict() for f in findings],
+        "facts": facts,
+        "alternatives": checks.alternatives(repo, data.get("topic_hits", [])),
+        "errors": data.get("errors", []),
+        "authenticated": authenticated,
+    }
+
+
+def vet(gh: GitHub, owner: str, name: str) -> dict:
+    return analyze(collect(gh, owner, name), authenticated=bool(gh.token))

repovet_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,181 @@
+Metadata-Version: 2.4
+Name: repovet-cli
+Version: 0.1.0
+Summary: Vet a GitHub repo for fake stars, abandonment, risky install scripts and typosquatting. Radar for new repos in your stack.
+Author: repovet contributors
+License: MIT
+Project-URL: Homepage, https://github.com/shivamkr06/repovet
+Project-URL: Issues, https://github.com/shivamkr06/repovet/issues
+Project-URL: Changelog, https://github.com/shivamkr06/repovet/blob/main/CHANGELOG.md
+Keywords: github,fake-stars,supply-chain-security,typosquatting,repository-analysis,trust-score,dependency-vetting,trending-repositories,cli,developer-tools
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# repovet
+
+**Check a GitHub repo for fake stars, abandonment, malware-style install scripts and typosquatting before you clone, install or depend on it. Also finds new repos that match your stack.**
+
+[![CI](https://github.com/shivamkr06/repovet/actions/workflows/ci.yml/badge.svg)](https://github.com/shivamkr06/repovet/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+![Python 3.9+](https://img.shields.io/badge/python-3.9%2B-blue)
+![Dependencies: none](https://img.shields.io/badge/dependencies-none-brightgreen)
+
+Hundreds of new repos trend on GitHub every week. Some are great, some are abandoned, some
+have bought their stars, and a few are malware with a nice README. `repovet` is a small
+command-line **GitHub repository trust scorer** that tells you which is which in a few
+seconds.
+
+- **`repovet vet owner/repo`** gives a 0-100 trust score, a verdict, and the reasons.
+- **`repovet radar`** lists recently created repos for the languages and topics your project uses.
+- Pure Python standard library. No dependencies. Works on Windows, macOS and Linux.
+- Output as text or `--json`. Exit code for CI gating with `--fail-under`.
+
+## Quick start
+
+```bash
+pip install repovet-cli
+```
+
+The command is `repovet`. From source instead:
+
+```bash
+pip install git+https://github.com/shivamkr06/repovet.git
+```
+
+```bash
+repovet vet psf/requests
+```
+
+Without installing, from a clone:
+
+```bash
+PYTHONPATH=src python -m repovet vet psf/requests
+```
+
+## Example
+
+```text
+$ repovet vet psf/requests
+
+psf/requests  https://github.com/psf/requests
+A simple, yet elegant, HTTP library.
+
+LOOKS OK  100/100  [####################]
+
+No red flags found.
+
+Facts
+  stars / forks / watchers   55k / 11k / 1.3k
+  issues + PRs ever          7.6k
+  age / last push            5749d / 8d ago
+  license                    Apache-2.0
+  contributors               100+
+  top author                 nateprewitt (46% of recent commits)
+  latest release             v2.34.2
+```
+
+A repo with problems looks like this:
+
+```text
+CAUTION  78/100  [################----]
+
+[MEDIUM] Stale
+         No push in 514 days.
+[LOW   ] Low fork-to-star ratio
+         9 forks vs 503 stars (1.8%). Real projects usually sit around 5-15%.
+[LOW   ] Single maintainer
+         m-ahmed-elbeskeri wrote 100% of the recent commits. If they leave, the project stops.
+```
+
+## What `vet` checks
+
+| Area | Signals |
+|---|---|
+| **Fake stars** | fork-to-star and watcher-to-star ratios, stars with almost no issues or PRs, sudden star spikes, share of brand-new or empty stargazer accounts (needs a token) |
+| **Maintenance** | archived or disabled, time since last push, commit count, project age |
+| **People** | single-maintainer risk, owner account age and track record |
+| **License** | missing, unrecognized, or restrictive (AGPL, SSPL, BUSL, non-commercial) |
+| **Install risk** | `preinstall`/`postinstall` hooks, `setup.py` that runs commands, `curl \| sh`, encoded PowerShell, obfuscated `exec`, Discord/Telegram webhooks, hard-coded IPs, committed executables, password-protected archives mentioned in the README |
+| **Identity** | same name as a bigger, older repo (typosquat or copy), forks, lookalike repos |
+
+It also lists similar repos with the same topics so you can compare before choosing.
+
+Scoring: start at 100, subtract 25 per high, 12 per medium, 5 per low finding. 80+ with no
+high findings is `LOOKS OK`, 55+ is `CAUTION`, below that is `HIGH RISK`.
+
+## Use it in CI
+
+Block a risky dependency before it lands:
+
+```bash
+repovet vet owner/repo --fail-under 60
+```
+
+Exit code is `2` when the score is below the threshold, `1` on errors, `0` otherwise.
+`--json` prints the full report for scripts.
+
+## Radar: new repos for your stack
+
+```bash
+repovet radar
+```
+
+Reads `package.json`, `requirements.txt`, `pyproject.toml`, `go.mod`, `Cargo.toml` and others
+in the current folder, then lists recently created repos in those languages and topics.
+Same-name clones are collapsed into one entry, and repos are ranked by stars per day with a
+penalty for hollow-looking traction (many stars, almost no forks).
+
+```bash
+repovet radar --lang Rust --topic cli --days 30 --min-stars 200
+```
+
+## GitHub token
+
+Works without a token, but the anonymous API allows about 6 vets per hour and the
+stargazer checks (fake accounts, star spikes) are skipped, because GitHub does not list
+stargazers anonymously. To lift both limits, set `GITHUB_TOKEN` (or `GH_TOKEN`) to a token
+with no scopes. Some tokens (seen on new GitHub accounts) get no stargazer data back from
+GitHub; `repovet` then skips those two checks and says so in a note. If the `gh` CLI is installed and logged in, its token is used automatically.
+
+Responses are cached for one hour in `~/.cache/repovet` (`--no-cache` to bypass,
+`REPOVET_CACHE` to move it). The token is only ever sent to `api.github.com`.
+
+## Limits
+
+These are heuristics. A flag is a reason to look closer, not proof of fraud, and a clean
+score is not a security audit. The install check reads a handful of entry-point files, not
+the whole codebase. Popular, legitimate projects can trip individual checks (a fast viral
+launch looks like a star spike). Treat the verdict as triage.
+
+## Development
+
+```bash
+python -m unittest discover -s tests
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for how to add a check. Report security issues as
+described in [SECURITY.md](SECURITY.md). Changes are listed in [CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+[MIT](LICENSE)
+
+<sub>Keywords: github repository analyzer, fake github stars detector, repo trust score,
+supply chain security, typosquatting detection, malicious repository checker, dependency
+vetting, trending repositories, open source discovery.</sub>

repovet_cli-0.1.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+repovet/__init__.py,sha256=TNkpSNV1UYCFpwDJfHrup2YjQFBCDE4_IAxOAgqP7Fg,77
+repovet/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
+repovet/checks.py,sha256=Z4YgyXOLaqWtZq27mFEKjmqS-3DeVsxqclcWMKz9n7Q,16865
+repovet/cli.py,sha256=_CNUhMVeXFrHkO276FvquRQUppVFd9S1Jl4wDi3_QG0,4271
+repovet/github.py,sha256=38jgMrt4OJ8gz8X_ZL_Huas3pIzBTXmPgYdt46W9CnA,5863
+repovet/radar.py,sha256=23OddelhT-fP4QrFR-WLwOJg29nAl9VEVyYVt4pBnHc,5763
+repovet/render.py,sha256=S6TI4objmmckzDEE5IyQ_u6tch0BOjgQJdygmgk43KQ,4638
+repovet/vet.py,sha256=DlC333DeDY1p_JZBnyzU1tf1Ssa6o_5PRaptZa-WRKo,7402
+repovet_cli-0.1.0.dist-info/licenses/LICENSE,sha256=DzoZqOVMVnq7vu7pWKtRvN4qIXWTQ6KHzzAVfO_qieU,1077
+repovet_cli-0.1.0.dist-info/METADATA,sha256=0TvuYV9TUDBRnI-btt3W0egdRgiSl0eJeLwgkiKOkwI,7091
+repovet_cli-0.1.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+repovet_cli-0.1.0.dist-info/entry_points.txt,sha256=l9kT5oq9FlPKFgvV0JPgnAQkM7W2sgNgYmx8x9_Sscs,45
+repovet_cli-0.1.0.dist-info/top_level.txt,sha256=5rC1z53MpyQ2G06ovrPJmMfE0IXU6PgcQ7THbIlmYYA,8
+repovet_cli-0.1.0.dist-info/RECORD,,

repovet_cli-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

repovet_cli-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+repovet = repovet.cli:main

repovet_cli-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 repovet contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

repovet_cli-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+repovet