[mvanhorn]

Summary

The @continuedev/terminal-security package already recognizes package-manager install commands (npm/yarn/pnpm install/add) via isHighRiskPackageManager and routes them to allowedWithPermission, but it only answers 'is this an install?' not 'what is being installed?'. A command like npm install lodahs (one edit away from lodash) is treated identically to a legitimate install, with no typosquat signal for the reviewer.

Changes

Extend evaluateTerminalCommandSecurity.ts to parse the target package name(s) out of recognized install/runner commands and compare each against a small bundled allowlist of popular packages using an edit-distance (Levenshtein <= 1-2, excluding exact matches) heuristic. Add npx/bunx/pnpm dlx/yarn dlx runner forms to the set of commands whose first non-flag argument is treated as a package target. When a near-miss is detected, attach a structured typosquat warning to the existing evaluation result (new optional field on the result type in types.ts) and ensure such commands stay at allowedWithPermission rather than silently auto-running, surfacing the suspected canonical name. Keep the allowlist and distance logic self-contained so it remains offline and dependency-free, matching the existing rule style in this file.

Fixes #12573

---

Summary by cubic

Add typosquat-target detection to @continuedev/terminal-security package-manager rule to flag suspicious install/runner targets and keep them permission-gated. Fixes #12573.

• New Features
  • Parse package targets from npm|yarn|pnpm install/add/i and runners npx, bunx, pnpm dlx, yarn dlx; check -p/--package (incl. --package=foo) as package targets and ignore non-package runner flags.
  • Detect near-miss names against a small bundled list of popular packages using bounded Levenshtein (<=2), skipping exact matches.
  • Attach typosquat-target warnings with packageName, suspectedPackageName, and distance; any warning forces at least allowedWithPermission.
  • Optional warnings via evaluateTerminalCommandSecurity(..., { includeWarnings: true }) or evaluateTerminalCommandSecurityDetailed; tests cover exact hits, typos, scoped/versions, runners and -p/--package cases, and negatives.

^{Written for commit f2197a2. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[mvanhorn]

Both open points here are stale, so a re-run should clear this.

cubic's P2 on getRunnerPackageTargets: already fixed. cubic reviewed 7082690; the fix landed the next day in f2197a2, which handles -p/--package before the generic skip-flag-value branch and captures the value as a typosquat candidate instead of stepping over it. Covered by the "should warn for runner package flags that look like typosquats" case for npx -p expres cowsay, npx --package expres cowsay, npx --package=expres cowsay, and pnpm dlx --package expres cowsay. 232/232 pass in packages/terminal-security locally.

On jetbrains-tests: the failure is Autocomplete > testAutocomplete(), a headless-IDE integration test. This PR touches only three files under packages/terminal-security/ (a pure TS evaluator, its types, and its test), so there is no path from this diff to that test. The run is also from June 18.

Could someone re-run the checks? Happy to rebase onto current main first if that is easier.