hacktronai/Hacktron Dependency Scan
Diff-aware npm and PyPI supply-chain scan for pull requests.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| lockfile | Single manifest to scan. If neither `lockfile` nor `lockfiles` is set, supported manifests are auto-discovered from tracked git files. | no | "" |
| lockfiles | Newline-separated list of manifest paths or bash-style path patterns. If unset, supported manifests are auto-discovered from tracked git files. | no | "" |
| ignore-file | Optional allowlist file; one name@version per line | no | .hfwignore |
| fail-on-malicious | Fail the check when the PR introduces malicious packages. Allowed: true, false. | no | true |
Outputs
| name | description |
|---|---|
| malicious_count | Number of malicious packages introduced by this PR |
| suspicious_count | Number of suspicious packages introduced by this PR |
| diff_count | Total packages added or changed in this PR |