Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add typosquatting analyzer for go modules #481

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

bthuilot
Copy link

@bthuilot bthuilot commented Oct 30, 2024

Changes

  • Adds typosquatting analyzer for go modules
  • Adds top_go_packages.json which contains top ~3000 go modules
    • List was gathered by searching for go.mod files on GitHub with more than 50 stars
    • Parsed the go.mod files and counted the amount of each pacakge used, then took all packages used in more than 10 repos

@bthuilot bthuilot self-assigned this Oct 30, 2024
@sobregosodd
Copy link
Contributor

sobregosodd commented Oct 30, 2024

which contains top 500 go modules

@bthuilot mind that we are using about 8k packages in other ecosystems for this detection

Signed-off-by: Bryce Thuilot <[email protected]>
Signed-off-by: Bryce Thuilot <[email protected]>
Copy link
Contributor

@juliendoutre juliendoutre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me but noticed a few commented code sections which may not be intentional?

guarddog/analyzer/metadata/go/typosquatting.py Outdated Show resolved Hide resolved
guarddog/analyzer/metadata/go/typosquatting.py Outdated Show resolved Hide resolved
guarddog/analyzer/metadata/go/typosquatting.py Outdated Show resolved Hide resolved
Signed-off-by: Bryce Thuilot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants