elementsinteractive/Twyn action

Security tool against dependency typosquatting attacks

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Nov 11, 2025
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: elementsinteractive/twyn-action@a2fcaefde71babfec476491163da2e7b97a7d29a # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
github-token	Token needed to publish results to the PR.	no	—
config	Path to the config file	no	—
dependency-file	Dependency file(s) to analyze. Comma-separated if multiple. By default, twyn will search in the current directory for supported files, but this option will override that behavior.	no	—
selector-method	Which method twyn should use to select possible typosquats. 'first-letter' only compares dependencies that share the first letter, 'nearby-letter' compares against dependencies whose first letter is nearby in an English keyboard. 'all' compares the given dependencies against all of those in the reference.	no	—
no-track	Do not show the progress bar while processing packages	no	false
json	Display the results in json format. It implies no-track. Mutually exclusive with --table.	no	false
table	Display the results in a table format. It implies no-track. Mutually exclusive with --json.	no	false
recursive	Recursively look for files when trying to locate them automatically. Ignored if dependency-file is given.	no	false
pypi-source	Alternative PyPI source URL to use for fetching trusted packages	no	—
npm-source	Alternative npm source URL to use for fetching trusted packages	no	—
v	Enable verbose output (-v)	no	false
vv	Enable extra verbose output (-vv)	no	false
version	Twyn version (latest, v1.0.0, etc.)	no	latest
publish	Whether to publish the twyn results as PR comments (requires table format)	no	false

Outputs

name	description
results	Raw output from twyn scan
exit-code	Exit code from twyn scan