feat: search for similar packages

[bcoe]

Problem Statement

We're looking for better ways at npm to mitigate typosquatting attacks based around popular package names.

The npx tool also has an issue open in which they're discussing using npm/npms.io's search engine to protect users from this category of attack, e.g.,

npx i babel-cl

Proposed Solution

Using npms.io's quality rankings, and ElasticSearch's fuzzy search functionality, this pull request introduces a new method search.similar that will return similar packages (including the package itself, as a note for implementers) if they meet an appropriate _score threshold, i.e.,

• the package is popular.
• and the package has a reasonably similar name.

CC: @zkat @rockbot

[coveralls]

Coverage decreased (-0.7%) to 99.31% when pulling 9b84fed on typosquatting into 18a7469 on master.

[coveralls]

Coverage decreased (-0.7%) to 99.31% when pulling 745d47a on typosquatting into 18a7469 on master.

[satazor]

Looks great!

[satazor]

Ping me tomorrow to launch a new version. I'm currently replying from the phone.