fix(typosquat): suppress scoped-package and short-name false positives (v0.5.5)

[pkuzco]

Summary

A real-world scan against an Astro/Wix project surfaced 34 typosquat false positives. Three patterns accounted for all of them, fixed in this PR:

1. Scoped packages compared against unscoped popular targets (15 FPs). The checker stripped the scope and compared the basename, so @babel/parser was flagged as a possible typosquat of parcel, @astrojs/prism of prisma, @floating-ui/core of ora, etc. But npm scopes carry verified ownership — @babel/parser is published by the babel team and cannot impersonate parcel. Skip the check entirely for scoped names. Detecting real scope-confusion attacks (@bable/lodash) needs per-scope reputation data we don't have; that's an explicit tradeoff documented in the code.

2. MAX_DISTANCE = 2 too lenient for short names (16 FPs). Distance 2 across 4-5 char names means ~half the characters differ — that's a different word, not a typo. Examples: asap/tsup, clsx/tsx, vfile/vite, regex/remix, defu/debug, nise/nest, jose/core, parse5/parcel. Switched to a length-adaptive threshold: require distance 1 when either name is shorter than 7 chars. Distance-1 short typos like lodsh/lodash are still caught.

3. Legit packages at distance 1 from popular targets (3 FPs). Allowlisted color, acorn, react-dnd, jose, prismjs — all widely-used real packages that sit at distance 1 from existing entries (colors, react-dom, @nestjs/core, etc.).

Of the 34 FPs in the original report, 31 disappear with these fixes. Remaining edge case: piccolore vs picocolors (genuinely suspicious-looking; kept flagged).

Test plan

• All 102 tests pass (npm test)
• Existing typosquat tests still cover lodahs/lodash (transposition), expres/express (deletion), cornmander/commander (homoglyph), reqests/requests (PyPI)
• New tests cover scoped-exemption and short-name behavior
• npm run build clean
• Manual scan of the original reproducer project (Astro/Wix) — expect ~3 typosquat flags instead of 34

🤖 Generated with Claude Code