Loading npm security reports…

githolon@0.100.4: Suspicious npm security report (Warn) | LPM Firewall

registry / githolon / 0.100.4

githolon@0.100.4

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 610 KB of source, external domains: 127.0.0.1, dev-idp.local, id.nomos.captainapp.co.uk, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk, unborn.invalid

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 2972-3012javascript

2972 }

2973 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2974 return { kind, stableIds: [...sids], raw };

2975}

2976function matchRepair(refusal, repairs) {

2977 if (refusal.kind === "other") return void 0;

2978 return repairs.find(

2979 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2980 );

2981}

2982function knownRepairBlock(repair) {

2983 return [

2984 "",

2985 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2986 ` reason: ${repair.reason}`,

2987 " Re-run with --repair to execute it."

2988 ].join("\n");

2989}

2990function resolveTsxCli(cwd) {

2991 const pkgDir = (name, fromDir) => {

2992 try {

2993 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2994 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2992

2995 return void 0;

2996 }

2997 };

2998 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2999 try {

3000 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

3001 } catch {

3002 return void 0;

3003 }

3004 })();

3005 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

3006 if (tsxDir === void 0) return void 0;

3007 try {

3008 const pkg = JSON.parse(

3009 readFileSync2(join3(tsxDir, "package.json"), "utf8")

3010 );

3011 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

3012 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5942-5982javascript

5942async function secretSet(ws, secret, opts) {

5943 setSecret(cloudBase(opts.cloud), ws, secret);

5944 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()

dist/dev-server.mjsView file

Lines 24-64javascript

24 return rel === "" ? [] : rel.split("/");

25 }

26 function resolve(ps) {

27 let

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 2972-3012javascript

2972 }

2973 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2974 return { kind, stableIds: [...sids], raw };

2975}

2976function matchRepair(refusal, repairs) {

2977 if (refusal.kind === "other") return void 0;

2978 return repairs.find(

2979 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2980 );

2981}

2982function knownRepairBlock(repair) {

2983 return [

2984 "",

2985 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2986 ` reason: ${repair.reason}`,

2987 " Re-run with --repair to execute it."

2988 ].join("\n");

2989}

2990function resolveTsxCli(cwd) {

2991 const pkgDir = (name, fromDir) => {

2992 try {

2993 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2994 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2992

2995 return void 0;

2996 }

2997 };

2998 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2999 try {

3000 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

3001 } catch {

3002 return void 0;

3003 }

3004 })();

3005 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

3006 if (tsxDir === void 0) return void 0;

3007 try {

3008 const pkg = JSON.parse(

3009 readFileSync2(join3(tsxDir, "package.json"), "utf8")

3010 );

3011 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

3012 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5942-5982javascript

5942async function secretSet(ws, secret, opts) {

5943 setSecret(cloudBase(opts.cloud), ws, secret);

5944 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()

dist/dev-server.mjsView file

Lines 24-64javascript

24 return rel === "" ? [] : rel.split("/");

25 }

26 function resolve(ps) {

27 let

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code