brennhill/sloppy-joe-secure

Catch hallucinated, typosquatted, and non-canonical dependencies before they reach production

Trust Signals

name	description	required	default
config	Config file path or HTTPS URL (e.g., https://raw.githubusercontent.com/yourorg/configs/main/sloppy-joe.json)	no	—
dir	Project directory to scan	no	.
type	Ecosystem type (npm, pypi, cargo, go, ruby, php, jvm, dotnet). Auto-detected by default.	no	—
deep	Enable transitive dependency similarity checks	no	false
paranoid	Enable bitflip mutation generators (slower, more thorough)	no	false
args	Additional arguments to pass to sloppy-joe check	no	""
version	sloppy-joe version to install (without v prefix). Defaults to latest.	no	latest

no outputs