registry / @david.zoufaly/noldor / 1.0.1

@david.zoufaly/noldor@1.0.1

**A discipline framework for agent-driven software development.** One mandatory gate for every code change, features anchored in docs, and an autonomous queue that ships small work while you sleep — with a live dashboard watching the whole pipeline.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 586 file(s), 2.81 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, cli.github.com, diataxis.fr, example.test, github.com, registry.npmjs.org, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 25-65json

25 "registry": "https://registry.npmjs.org"

26 },

27 "scripts": {

28 "build": "tsc",

29 "noldor": "node bin/noldor.mjs",

30 "dashboard": "node bin/noldor.mjs dashboard server",

31 "test": "vitest run",

32 "test:contract": "node scripts/test-contract.mjs",

33 "test:e2e:drain": "vitest run src/testing/__tests__/drain-e2e.test.ts",

34 "typecheck": "tsc --noEmit",

35 "lint": "oxlint --deny-warnings",

36 "lint:fix": "oxlint --fix",

37 "fmt": "node bin/noldor.mjs fmt",

38 "fmt:check": "node bin/noldor.mjs fmt --check",

39 "verify": "pnpm lint && pnpm fmt:check && pnpm typecheck && pnpm test",

40 "toon": "node bin/noldor.mjs graphify graph-to-toon graphify-out/graph.json",

41 "graphify:enrich-docs": "node bin/noldor.mjs graphify enrich-docs graphify-out/graph.json",

42 "release": "node bin/noldor.mjs release run",

43 "clean": "rm -rf dist .turbo",

44 "prepare": "tsc",

45 "postinstall": "lefthook install || echo 'lefthook not found - skipping hook install (expected when installed as a dependency)'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "@inquirer/prompts": "^8.4.3",

49 "dependency-cruiser": "^16.10.0",

50 "gray-matter": "^4.0.3",

51 "highlight.js": "^11.10.0",

52 "marked": "^18.0.3",

53 "marked-highlight": "^2.2.1",

54 "minimatch": "^10.2.5",

55 "semver": "^7.7.4",

56 "tsx": "^4.21.0",

57 "yaml": "^2.8.3",

58 "zod": "^3.24.0",

59 "zod-to-json-schema": "^3.25.2"

60 },

61 "devDependencies": {

62 "@types/node": "^22.0.0",

63 "@types/semver": "^7.7.1",

64 "lefthook": "^2.1.9",

65 "oxfmt": "^0.52.0",

bin/noldor-stub-gate.mjsView file

Lines 1-10javascript

1#!/usr/bin/env node

2import { register } from 'tsx/esm/api';

3import { fileURLToPath } from 'node:url';

4import { resolve, dirname } from 'node:path';

6register();

7const here = dirname

dist/cr/deep-review-spawn.jsView file

Lines 1-21javascript

1import { execFile } from 'node:child_process';

2import { createHash } from 'node:crypto';

3import { readFile } from 'node:fs/promises';

4import { join } from 'node:path';

5import { CLAUDE_BIN } from '../core/agent-runner/runners/claude.js';

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = lefthook install || echo 'lefthook not found - skipping hook install (expected when installed as a dependency)'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = lefthook install || echo 'lefthook not found - skipping hook install (expected when installed as a dependency)'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/noldor-stub-gate.mjsView file

7const here = dirname(fileURLToPath(import.meta.url)); L8: const { main } = await import(resolve(here, '../src/testing/stub-gate.ts')); L9: process.exit(main(process.argv));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/noldor-stub-gate.mjsView on unpkg · L7

dist/cr/deep-review-spawn.jsView file

1import { execFile } from 'node:child_process'; L2: import { createHash } from 'node:crypto'; ... L11: return new Promise((resolveP, rejectP) => { L12: execFile(cmd, args, opts, (err, stdout, stderr) => { L13: if (err)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cr/deep-review-spawn.jsView on unpkg · L1

Findings

1 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/noldor-stub-gate.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cr/deep-review-spawn.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 25-65json

25 "registry": "https://registry.npmjs.org"

26 },

27 "scripts": {

28 "build": "tsc",

29 "noldor": "node bin/noldor.mjs",

30 "dashboard": "node bin/noldor.mjs dashboard server",

31 "test": "vitest run",

32 "test:contract": "node scripts/test-contract.mjs",

33 "test:e2e:drain": "vitest run src/testing/__tests__/drain-e2e.test.ts",

34 "typecheck": "tsc --noEmit",

35 "lint": "oxlint --deny-warnings",

36 "lint:fix": "oxlint --fix",

37 "fmt": "node bin/noldor.mjs fmt",

38 "fmt:check": "node bin/noldor.mjs fmt --check",

39 "verify": "pnpm lint && pnpm fmt:check && pnpm typecheck && pnpm test",

40 "toon": "node bin/noldor.mjs graphify graph-to-toon graphify-out/graph.json",

41 "graphify:enrich-docs": "node bin/noldor.mjs graphify enrich-docs graphify-out/graph.json",

42 "release": "node bin/noldor.mjs release run",

43 "clean": "rm -rf dist .turbo",

44 "prepare": "tsc",

45 "postinstall": "lefthook install || echo 'lefthook not found - skipping hook install (expected when installed as a dependency)'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "@inquirer/prompts": "^8.4.3",

49 "dependency-cruiser": "^16.10.0",

50 "gray-matter": "^4.0.3",

51 "highlight.js": "^11.10.0",

52 "marked": "^18.0.3",

53 "marked-highlight": "^2.2.1",

54 "minimatch": "^10.2.5",

55 "semver": "^7.7.4",

56 "tsx": "^4.21.0",

57 "yaml": "^2.8.3",

58 "zod": "^3.24.0",

59 "zod-to-json-schema": "^3.25.2"

60 },

61 "devDependencies": {

62 "@types/node": "^22.0.0",

63 "@types/semver": "^7.7.1",

64 "lefthook": "^2.1.9",

65 "oxfmt": "^0.52.0",

bin/noldor-stub-gate.mjsView file

Lines 1-10javascript

1#!/usr/bin/env node

2import { register } from 'tsx/esm/api';

3import { fileURLToPath } from 'node:url';

4import { resolve, dirname } from 'node:path';

6register();

7const here = dirname

dist/cr/deep-review-spawn.jsView file

Lines 1-21javascript

1import { execFile } from 'node:child_process';

2import { createHash } from 'node:crypto';

3import { readFile } from 'node:fs/promises';

4import { join } from 'node:path';

5import { CLAUDE_BIN } from '../core/agent-runner/runners/claude.js';