Identify suspicious version numbers

[christophetd]

Such as 999.9.9, very large numbers (more than 4 digits without a dot)

[Taiki-San]

This would match year-based versioning, no? 2024.12?

[sobregosodd]

I'm not so sure about this one, I don't see how this could determine if a package is malicious or risky based on this

[christophetd]

Probably 5-6 digits then. Need to check the data, but I doubt we have a lot of legit packages with a single version numbered 9999999999

[sobregosodd]

Let's look at the data first, I've seen several legit packages with date-like versioning, and non other semver approaches.
If we consider it makes sense, we should replace release_zero

[netcode]

If the concern is the FP Lets run query against our DB and check the result.