You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Twyn is a security tool that compares the name of your dependencies against a set of the most popular ones,
11
+
Twyn is a security tool that compares the name of your dependencies against a set of the most popular ones,
13
12
in order to determine if there is any similarity between them, preventing you from using a potentially illegitimate one.
14
13
In short, Twyn protects you against [typosquatting attacks](https://en.wikipedia.org/wiki/Typosquatting).
15
14
@@ -20,79 +19,121 @@ It works as follows:
20
19
3. If the name of your package is similar to the name of one of the most used packages, Twyn will prompt an error.
21
20
4. If your package name is not in the list of the most known ones and is not similar enough to any of those to be considered misspelled, the package is accepted. Twyn assumes that you're using either a not so popular package (therefore it can't verify its legitimacy) or a package created by yourself, therefore unknown for the rest.
22
21
23
-
## Docker
24
-
Twyn provides a Docker image, which can be found [here](https://hub.docker.com/r/elementsinteractive/twyn).
25
-
26
22
## Quickstart
23
+
27
24
### Installation
25
+
28
26
Twyn is available on PyPi repository, you can install it by running
29
-
30
-
pip install twyn
27
+
28
+
```sh
29
+
pip install twyn
30
+
```
31
+
32
+
### Docker
33
+
34
+
Twyn provides a Docker image, which can be found [here](https://hub.docker.com/r/elementsinteractive/twyn).
35
+
36
+
Use it like so:
37
+
38
+
```sh
39
+
docker pull elementsinteractive/twyn:latest
40
+
docker run elementsinteractive/twyn --help
41
+
```
31
42
32
43
### Run
44
+
33
45
To run twyn simply type:
34
46
35
-
twyn run <OPTIONS>
47
+
```sh
48
+
twyn run <OPTIONS>
49
+
```
36
50
37
51
For a list of all the available options as well as their expected arguments run:
38
52
39
-
twyn run --help
40
-
53
+
```sh
54
+
twyn run --help
55
+
```
41
56
42
57
## Configuration
43
58
44
59
### Allowlist
60
+
45
61
It can happen that a legitimate package known by the user raises an error because is too similar to one of the most trusted ones.
46
62
You can then add this packages to the `allowlist`, so it will be skipped:
47
63
48
-
twyn allowlist add <package>
64
+
```sh
65
+
twyn allowlist add <package>
66
+
```
49
67
50
68
To remove it simply:
51
69
52
-
twyn allowlist remove <package>
70
+
```sh
71
+
twyn allowlist remove <package>
72
+
```
53
73
54
74
### Dependency files
75
+
55
76
To specify a dependency file through the command line run:
56
77
57
-
twyn run --dependency-file <file path>
78
+
```sh
79
+
twyn run --dependency-file <file path>
80
+
```
81
+
82
+
Currently it supports these dependency file formats:
58
83
59
-
Currently it supports these dependency file formats.
60
84
-`requirements.txt`
61
85
-`poetry.lock`
62
86
63
87
### Check dependencies introduced through the CLI
88
+
64
89
You can also check a dependency by entering it through the command line:
65
90
66
-
twyn run --dependency <dependency>
91
+
```sh
92
+
twyn run --dependency <dependency>
93
+
```
67
94
68
95
It does accept multiple dependencies at a time:
69
96
70
-
twyn run --dependency <dependency> --dependency <another_dependency>
97
+
```sh
98
+
twyn run --dependency <dependency> --dependency <another_dependency>
99
+
```
71
100
72
101
When this option is selected, no dependency file is checked.
73
102
74
103
### Selector method
75
-
You can choose between different operational modes:
76
-
-`all`: Default option. It is the most exhaustive mode. It will check your package names against the trusted ones without any assumption.
77
-
-`nearby-letter`: will consider a possible typo in the first letter of your package name, so it will also consider all the nearby characters (in an English keyboard) when computing the distance between words.
78
-
-`first-letter`: will assume the first letter of your package is correct. It is the fastest mode but the least reliable one.
104
+
105
+
You can choose between different operational modes. These will determine which dependencies from the trusted set the analyzed dependency can be a typosquat of.
106
+
107
+
-`all`: Default option. It is the most exhaustive mode. It will check your package names against all the trusted ones without any assumption.
108
+
-`nearby-letter`: It will assume a typo on the first letter of the dependency is possible, but improbable if letters are farther apart in the keyboard. Specifically, it will compare the analyzed dependency against dependencies whose first letter is one step away in an `ANSI` keyboard layout.
109
+
-`first-letter`: It will assume a typo on the first letter is very improbable, and won't compare the analyzed dependency against dependencies with a different first letter.
110
+
111
+
> [!NOTE]
112
+
> Selecting an option is a matter of preference: `all` is the slowest, but will have more false positives and less false negatives; while `first-letter` is the fastest, but it will have less false positives and more false negatives.
79
113
80
114
To select a specific operational mode through the CLI use the following command
81
115
82
-
twyn run --selector-method <method>
116
+
```sh
117
+
twyn run --selector-method <method>
118
+
```
83
119
84
120
### Configuration file
121
+
85
122
You can save your configurations in a `.toml` file, so you don't need to specify them everytime you run Twyn in your terminal.
86
123
87
124
By default, it will try to find a `pyproject.toml` file in your working directory when it's trying to load your configurations.
88
125
However, you can specify a config file as follows:
89
-
90
-
twyn run --config <file>
91
126
92
-
All the configurations available through the command line are also supported in the config file.
127
+
```sh
128
+
twyn run --config <file>
129
+
```
130
+
131
+
All the configurations available through the command line are also supported in the config file.
0 commit comments