registry / @holoscript/holorepo / 0.7.1

@holoscript/holorepo@0.7.1

Sovereign GitHub + DB + HoloScript knowledge store with living repository portraits for agents and humans.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 445 KB of source, external domains: 127.0.0.1, absorb.holoscript.net, github.com, pypi.org, registry.npmjs.org

Source & flagged code

6 flagged

src/absorb.mjsView file

Lines 44-84javascript

44function absorbConfig(config) {

45 return {

46 mode: 'optional-adapter',

47 role: 'graphrag-enrichment',

48 package: '@holoscript/absorb-service',

49 localMcpUrl: DEFAULT_LOCAL_MCP_URL,

50 remoteUrlEnv: 'ABSORB_SERVICE_URL',

51 apiKeyEnv: 'ABSORB_API_KEY',

52 defaultProvider: 'local-holograph-holoembed',

53 custodyBoundary: 'HoloRepo owns source, DB, KS, repoGraph, and receipts; Absorb-Service enriches them with chunks, embeddings, GraphRAG, provenance answers, diffs, and HoloScript transform suggestions.',

54 ...(config.agentDependencies?.absorbService || {}),

55 };

56}

58function redactUrl(value) {

59 const raw = String(value || '');

60 if (!raw) return '';

61 try {

62 const url = new URL(raw);

63 if (url.username) url.username = 'redacted';

64 if (url.password) url.password = 'redacted';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/absorb.mjsView on unpkg · L64

65 return url.toString();

66 } catch {

67 return raw.replace(/\/\/([^:@/\s]+):([^@/\s]+)@/u, '//redacted:redacted@');

68 }

69}

71function jsonFileDigest(file) {

72 return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')}`;

73}

75function readJsonIfPath(value, cwd = process.cwd()) {

76 if (!value) return { value: null, path: null, digest: null };

77 const resolved = path.resolve(cwd, value);

78 const raw = fs.readFileSync(resolved);

79 const text = raw.toString('utf8').replace(/^\uFEFF/u, '');

80 return {

81 value: JSON.parse(text),

82 path: resolved,

83 digest: `sha256:${crypto.createHash('sha256').update(raw).digest('hex')}`,

84 };

src/embedder.mjsView file

Lines 1-37javascript

1// Optional sovereign encoder resolution for semantic KS recall.

2//

3// The package stays dependency-free (F.145): @holoscript/holoembed is an OPTIONAL

4// peer, not a hard dependency. When it is installed, resolveHoloEmbed() returns a

5// ready (text) => number[] encoder in the HoloEmbed-768 sovereign space — the same

6// space the KS embeddings live in — using the deterministic CPU path (no GPU, no

7// network, no foreign model). When it is absent, callers get a clear install hint

8// instead of a crash, so a guest without the encoder degrades to keyword search.

9//

10// The vector space IS the sovereignty boundary (W.763): a query must be encoded by

src/ci.mjsView file

Lines 18-58javascript

18 Object.entries(value)

19 .sort(([left], [right]) => left.localeCompare(right))

20 .map(([key, child]) => [key, stableValue(child)]),

21 );

22}

24function

src/git.mjsView file

Lines 17-57javascript

17 Object.entries(value)

18 .sort(([left], [right]) => left.localeCompare(right))

19 .map(([key, child]) => [key, stableValue(child)]),

20 );

21}

23function

src/config.mjsView file

Lines 193-274javascript

193 if (config.$schema && !config.schema) config.schema = config.$schema;

194 const profile = env.HOLOREPO_CONFIG_PROFILE || config.activeProfile || config.profile;

195 if (profile && config.profiles?.[profile]) {

196 config = deepMerge(config, config.profiles[profile]);

Source & flagged code

6 flagged · loading source

src/absorb.mjsView file

64patternName = generic_password severity = medium line = 64 matchedText = if (url....ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/absorb.mjsView on unpkg · L64

src/embedder.mjsView file

17try { L18: mod = await import(encoderModule); L19: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/embedder.mjsView on unpkg · L17

src/ci.mjsView file

38patternName = generic_password severity = medium line = 38 matchedText = if (url....ed';

Medium

Secret Pattern

Hardcoded password in src/ci.mjs

src/ci.mjsView on unpkg · L38

src/git.mjsView file

37patternName = generic_password severity = medium line = 37 matchedText = if (url....ed';

Medium

Secret Pattern

Hardcoded password in src/git.mjs

src/git.mjsView on unpkg · L37

src/config.mjsView file

213patternName = generic_password severity = medium line = 213 matchedText = if (url....ed';

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L213

254patternName = generic_password severity = medium line = 254 matchedText = redacted...d>';

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L254

Findings

7 Medium4 Low

MediumSecret Patternsrc/absorb.mjs

MediumDynamic Requiresrc/embedder.mjs

MediumEnvironment Vars

MediumSecret Patternsrc/ci.mjs

MediumSecret Patternsrc/git.mjs

MediumSecret Patternsrc/config.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

src/absorb.mjsView file

Lines 44-84javascript

44function absorbConfig(config) {

45 return {

46 mode: 'optional-adapter',

47 role: 'graphrag-enrichment',

48 package: '@holoscript/absorb-service',

49 localMcpUrl: DEFAULT_LOCAL_MCP_URL,

50 remoteUrlEnv: 'ABSORB_SERVICE_URL',

51 apiKeyEnv: 'ABSORB_API_KEY',

52 defaultProvider: 'local-holograph-holoembed',

54 ...(config.agentDependencies?.absorbService || {}),

55 };

56}

58function redactUrl(value) {

59 const raw = String(value || '');

60 if (!raw) return '';

61 try {

62 const url = new URL(raw);

63 if (url.username) url.username = 'redacted';

64 if (url.password) url.password = 'redacted';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/absorb.mjsView on unpkg · L64

65 return url.toString();

66 } catch {

67 return raw.replace(/\/\/([^:@/\s]+):([^@/\s]+)@/u, '//redacted:redacted@');

68 }

69}

71function jsonFileDigest(file) {

72 return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')}`;

73}

75function readJsonIfPath(value, cwd = process.cwd()) {

76 if (!value) return { value: null, path: null, digest: null };

77 const resolved = path.resolve(cwd, value);

78 const raw = fs.readFileSync(resolved);

79 const text = raw.toString('utf8').replace(/^\uFEFF/u, '');

80 return {

81 value: JSON.parse(text),

82 path: resolved,

83 digest: `sha256:${crypto.createHash('sha256').update(raw).digest('hex')}`,

84 };

src/embedder.mjsView file

Lines 1-37javascript

1// Optional sovereign encoder resolution for semantic KS recall.

2//

3// The package stays dependency-free (F.145): @holoscript/holoembed is an OPTIONAL

4// peer, not a hard dependency. When it is installed, resolveHoloEmbed() returns a

5// ready (text) => number[] encoder in the HoloEmbed-768 sovereign space — the same

6// space the KS embeddings live in — using the deterministic CPU path (no GPU, no

7// network, no foreign model). When it is absent, callers get a clear install hint

8// instead of a crash, so a guest without the encoder degrades to keyword search.

9//

10// The vector space IS the sovereignty boundary (W.763): a query must be encoded by

src/ci.mjsView file

Lines 18-58javascript

18 Object.entries(value)

19 .sort(([left], [right]) => left.localeCompare(right))

20 .map(([key, child]) => [key, stableValue(child)]),

21 );

22}

24function

src/git.mjsView file

Lines 17-57javascript

17 Object.entries(value)

18 .sort(([left], [right]) => left.localeCompare(right))

19 .map(([key, child]) => [key, stableValue(child)]),

20 );

21}

23function

src/config.mjsView file

Lines 193-274javascript

193 if (config.$schema && !config.schema) config.schema = config.$schema;

194 const profile = env.HOLOREPO_CONFIG_PROFILE || config.activeProfile || config.profile;

195 if (profile && config.profiles?.[profile]) {

196 config = deepMerge(config, config.profiles[profile]);