registry / claude-nomad / 0.58.0

claude-nomad@0.58.0

Sync Claude Code config (~/.claude/) across machines via a private Git repo, with path remapping and per-host settings overrides.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 275 KB of source, external domains: cli.github.com, funkadelic.github.io, github.com, json.schemastore.org, registry.npmjs.org

Source & flagged code

7 flagged

.gitleaks.tomlView file

Lines 28-71text

28]

29paths = [

30 '''^shared/projects/[^/]+/.*\.jsonl$''',

31]

32condition = "AND"

34# Path-scoped: the documented test-fixture github-pat literal AND the three

35# entropy-variant placeholders (zero-suffix, alphabet, repeat-A) accumulate

36# in Claude Code session transcripts whenever a conversation touches the

37# Pitfall 4 docs, this allowlist itself, or a session-scrub discussion that

38# names one of the variants. Live sessions cannot be safely sed-scrubbed

Source & flagged code

7 flagged · loading source

.gitleaks.tomlView file

48patternName = github_pat severity = critical line = 48 matchedText = '''ghp_x...''',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.gitleaks.tomlView on unpkg · L48

48patternName = github_pat severity = critical line = 48 matchedText = '''ghp_x...''',

Critical

Secret Pattern

GitHub personal access token in .gitleaks.toml

.gitleaks.tomlView on unpkg · L48

49patternName = github_pat severity = critical line = 49 matchedText = '''ghp_x...''',

Critical

Secret Pattern

GitHub personal access token in .gitleaks.toml

.gitleaks.tomlView on unpkg · L49

50patternName = github_pat severity = critical line = 50 matchedText = '''ghp_A...''',

Critical

Secret Pattern

GitHub personal access token in .gitleaks.toml

.gitleaks.tomlView on unpkg · L50

51patternName = github_pat severity = critical line = 51 matchedText = '''ghp_A...''',

Critical

Secret Pattern

GitHub personal access token in .gitleaks.toml

.gitleaks.tomlView on unpkg · L51

dist/nomad.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-nomad@0.56.1 matchedIdentity = npm:Y2xhdWRlLW5vbWFk:0.56.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/nomad.mjsView on unpkg

103var env = p.env || {}; L104: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L105: var formatter = (open, close, replace = open) => (input) => { ... L183: bold = (s) => enabled ? import_picocolors.default.bold(s) : s; L184: wslNarrowPad = process.env.WSL_DISTRO_NAME ? " " : ""; L185: okGlyph = `\u2713${wslNarrowPad}`; ... L192: // src/utils.ts L193: import { execFileSync } from "node:child_process"; L194: function gitCaptureRaw(args, cwd) { ... L212: const e = err; L213: if (e.stderr) process.stderr.write(e.stderr); L214: throw new NomadFatal(`${context} failed`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/nomad.mjsView on unpkg · L103

Findings

5 Critical1 High2 Medium5 Low

CriticalCritical Secret.gitleaks.toml

CriticalSecret Pattern.gitleaks.toml

HighPrevious Version Dangerous Deltadist/nomad.mjs

MediumEnvironment Vars

MediumInstall Persistencedist/nomad.mjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/nomad.mjsView file

Lines 83-123javascript

83 // .env, .env.local, .env.production

84 /\.pem$/i,

85 /\.key$/i,

86 /\.p12$/i,

87 /\.pfx$/i,

88 /^id_(rsa|dsa|ecdsa|ed25519)$/i,

89 /^\.netrc$/i,

90 /^\.npmrc$/i,

91 /^\.pgpass$/i,

92 /^\.git-credentials$/i,

93 /^credentials$/i

94 ];

95 }

96});

98// node_modules/picocolors/picocolors.js

99var require_picocolors = __commonJS({

100 "node_modules/picocolors/picocolors.js"(exports, module) {

101 var p = process || {};

102 var argv = p.argv || [];

103 var env = p.env || {};

104 var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" ||

105 var formatter = (open, close, replace = open) => (input) => {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/nomad.mjsView on unpkg · L103

106 let string = "" + input, index = string.indexOf(close, open.length);

107 return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;

108 };

109 var replaceClose = (string, close, replace, index) => {

110 let result = "", cursor = 0;

111 do {

112 result += string.substring(cursor, index) + replace;

113 cursor = index + close.length;

114 index = string.indexOf(close, cursor);

115 } while (~index);

116 return result + string.substring(cursor);

117 };

118 var createColors = (enabled2 = isColorSupported) => {

119 let f = enabled2 ? formatter : () => String;

120 return {

121 isColorSupported: enabled2,

122 reset: f("\x1B[0m", "\x1B[0m"),

123 bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/nomad.mjsView on unpkg