fix: check returned pypi name against requested name

lib/datasource/pypi.js

@@ -17,6 +17,13 @@ async function getDependency(purl) {
       logger.debug({ depName }, 'pip package not found');
       return null;
     }
+    if (!(dep.info && dep.info.name === depName)) {
+      logger.warn(
+        { lookupName: depName, returnedName: dep.name },
+        'Returned name does not match with requested name'
+      );
+      return null;
+    }
     if (dep.info && dep.info.home_page) {
       if (dep.info.home_page.startsWith('https://github.com')) {
         dependency.repositoryUrl = dep.info.home_page;

test/datasource/pypi.spec.js

@@ -30,6 +30,7 @@ describe('datasource/pypi', () => {
       got.mockReturnValueOnce({
         body: {
           info: {
+            name: 'something',
             home_page: 'https://microsoft.com',
           },
         },
@@ -38,5 +39,16 @@ describe('datasource/pypi', () => {
         await datasource.getDependency('pkg:pypi/something')
       ).toMatchSnapshot();
     });
+    it('returns null if mismatched name', async () => {
+      got.mockReturnValueOnce({
+        body: {
+          info: {
+            name: 'something-else',
+            home_page: 'https://microsoft.com',
+          },
+        },
+      });
+      expect(await datasource.getDependency('pkg:pypi/something')).toBeNull();
+    });
   });
 });