registry / @conscience-technology/nora / 0.0.2

@conscience-technology/nora@0.0.2

Drive the Nora platform from your terminal — agents, tools, refinery pipelines, memory, publish/rollback. Ships as a native binary; the npm wrapper downloads the right build for your OS on install.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 9.25 KB of source, external domains: github.com

Source & flagged code

3 flagged

package.jsonView file

Lines 13-47json

13 "mcp"

14 ],

15 "homepage": "https://nora.my",

16 "repository": {

17 "type": "git",

18 "url": "https://github.com/Conscience-Technology/agent_os",

19 "directory": "npm"

20 },

21 "bugs": "https://github.com/Conscience-Technology/agent_os/issues",

22 "license": "SEE LICENSE IN LICENSE",

23 "author": "Conscience Technology",

24 "bin": {

25 "nora": "bin/nora.js"

26 },

27 "files": [

28 "bin/nora.js",

29 "scripts/postinstall.js",

30 "README.md"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "engines": {

36 "node": ">=18.0.0"

37 },

38 "os": [

39 "darwin",

40 "linux"

41 ],

42 "cpu": [

43 "x64",

44 "arm64"

45 ]

46}

bin/nora.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Thin shim that execs the native `nora` binary the postinstall hook

3// downloaded. Kept as small as possible — every millisecond of Node

4// startup shows up on every CLI invocation.

5//

6// We use spawnSync + inherit stdio so:

7// • the child sees the same tty (masked prompts / colored output

8// work as expected),

9// • signals (Ctrl-C) propagate,

10// • the exit code round-trips through the Node process to the shell.

12'use strict'

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nora.jsView file

13L14: const { spawnSync } = require('child_process'); L15: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nora.jsView on unpkg · L13

Findings

1 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/nora.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

package.jsonView file

Lines 13-47json

13 "mcp"

14 ],

15 "homepage": "https://nora.my",

16 "repository": {

17 "type": "git",

18 "url": "https://github.com/Conscience-Technology/agent_os",

19 "directory": "npm"

20 },

21 "bugs": "https://github.com/Conscience-Technology/agent_os/issues",

22 "license": "SEE LICENSE IN LICENSE",

23 "author": "Conscience Technology",

24 "bin": {

25 "nora": "bin/nora.js"

26 },

27 "files": [

28 "bin/nora.js",

29 "scripts/postinstall.js",

30 "README.md"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "engines": {

36 "node": ">=18.0.0"

37 },

38 "os": [

39 "darwin",

40 "linux"

41 ],

42 "cpu": [

43 "x64",

44 "arm64"

45 ]

46}

bin/nora.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Thin shim that execs the native `nora` binary the postinstall hook

3// downloaded. Kept as small as possible — every millisecond of Node

4// startup shows up on every CLI invocation.

5//

6// We use spawnSync + inherit stdio so:

7// • the child sees the same tty (masked prompts / colored output

8// work as expected),

9// • signals (Ctrl-C) propagate,

10// • the exit code round-trips through the Node process to the shell.

12'use strict'