Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 39 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,48 +5,48 @@
[![Python Version](https://img.shields.io/badge/python-3.9%20%7C%203.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue?logo=python&logoColor=yellow)](https://pypi.org/project/twyn/)
[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
[![License](https://img.shields.io/github/license/elementsinteractive/twyn)](LICENSE)

![](https://github.com/elementsinteractive/twyn/blob/main/assets/twyn.gif)

## Table of Contents

- [Overview](#overview)
- [Quickstart](#quickstart)
- [Installation](#installation)
- [Docker](#docker)
- [Run](#run)
- [JSON Format](#json-format)
- [Configuration](#configuration)
- [Allowlist](#allowlist)
- [Dependency files](#dependency-files)
- [Check dependencies introduced through the CLI](#check-dependencies-introduced-through-the-cli)
- [Selector method](#selector-method)
- [Configuration file](#configuration-file)
- [Cache] (#cache)
- [Using `Twyn` as a library] (#using-twyn-as-a-library)

## Overview
Twyn is a security tool that compares the name of your dependencies against a set of the most popular ones,
`Twyn` is a security tool that compares the name of your dependencies against a set of the most popular ones,
in order to determine if there is any similarity between them, preventing you from using a potentially illegitimate one.
In short, Twyn protects you against [typosquatting attacks](https://en.wikipedia.org/wiki/Typosquatting).
In short, `Twyn` protects you against [typosquatting attacks](https://en.wikipedia.org/wiki/Typosquatting).

It works as follows:

1. Either choose to scan the dependencies in a dependencies file you specify (`--dependency-file`) or some dependencies introduced through the CLI (`--dependency`). If no option was provided, it will try to find a dependencies file in your working path.
2. If the name of your package name matches with the name of one of the most well known packages, the package is accepted.
3. If the name of your package is similar to the name of one of the most used packages, Twyn will prompt an error.
4. If your package name is not in the list of the most known ones and is not similar enough to any of those to be considered misspelled, the package is accepted. Twyn assumes that you're using either a not so popular package (therefore it can't verify its legitimacy) or a package created by yourself, therefore unknown for the rest.
3. If the name of your package is similar to the name of one of the most used packages, `Twyn` will prompt an error.
4. If your package name is not in the list of the most known ones and is not similar enough to any of those to be considered misspelled, the package is accepted. `Twyn` assumes that you're using either a not so popular package (therefore it can't verify its legitimacy) or a package created by yourself, therefore unknown for the rest.

## Quickstart

### Installation

Twyn is available on PyPi repository, you can install it by running
`Twyn` is available on PyPi repository, you can install it by running

```sh
pip install twyn
```

### Docker

Twyn provides a Docker image, which can be found [here](https://hub.docker.com/r/elementsinteractive/twyn).
`Twyn` provides a Docker image, which can be found [here](https://hub.docker.com/r/elementsinteractive/twyn).

Use it like so:

Expand All @@ -69,6 +69,18 @@ For a list of all the available options as well as their expected arguments run:
twyn run --help
```

### JSON format
If you want your output in JSON format, you can run `Twyn` with the following flag:

```python
twyn run --json
```
This will output:

```json
{"errors":[{"dependency":"reqests","similars":["requests","grequests"]}]}
```

## Configuration

### Allowlist
Expand Down Expand Up @@ -135,7 +147,7 @@ twyn run --selector-method <method>

### Configuration file

You can save your configurations in a `.toml` file, so you don't need to specify them everytime you run Twyn in your terminal.
You can save your configurations in a `.toml` file, so you don't need to specify them everytime you run `Twyn` in your terminal.

By default, it will try to find a `pyproject.toml` file in your working directory when it's trying to load your configurations.
However, you can specify a config file as follows:
Expand Down Expand Up @@ -171,7 +183,7 @@ The file format for each reference is as follows:
```

### Cache
By default, Twyn will cache the list of trusted packages to a cache file (.twyn/trusted_packages.json).
By default, `Twyn` will cache the list of trusted packages to a cache file (.twyn/trusted_packages.json).

You can disable the cache by adding the following flag:

Expand All @@ -185,4 +197,20 @@ Cache file is valid for 30 days, after that period it will download again the tr
To clear the cache, run:
```python
twyn run cache clear
```


### Using Twyn as a library

`Twyn` also supports being used as 3rd party library for you project.

```python
from twyn import check_dependencies

typos = check_dependencies("all")

for typo in typos.errors:
print(f"Dependency:{typo.dependency}")
print(f"Did you mean any of [{','.join(typo.similars)}]")

```