registry / githolon / 0.44.0

githolon@0.44.0

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 234 KB of source, external domains: 127.0.0.1, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 8-48javascript

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/governance.ts

13var governance_exports = {};

14__export(governance_exports, {

15 governanceOffer: () => governanceOffer,

16 governanceRelay: () => governanceRelay,

17 grantOrRevoke: () => grantOrRevoke,

18 keyEnroll: () => keyEnroll,

19 keyExport: () => keyExport,

20 keyImport: () => keyImport,

21 keyShow: () => keyShow,

22 resolveGovernancePrincipal: () => resolveGovernancePrincipal,

23 signAndPostGovernance: () => signAndPostGovernance,

24 signAndPostOffer: () => signAndPostOffer

25});

26import { createHash, createPrivateKey, createPublicKey } from "node:crypto";

27import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";

28async function clientConnect() {

29 const mod = await import("@githolon/client");

30 return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L28

31}

32async function connectGovernance(cloud, parent) {

33 const authToken = await sessionToken().catch(() => void 0);

34 const clientId = `githolon-cli-${Date.now().toString(16)}`;

35 const connect = await clientConnect();

36 return await connect({

37 cloud,

38 workspace: parent,

39 clientId,

40 ...authToken !== void 0 ? { authToken } : {}

41 });

42}

43async function ensureDeviceKey(holon, principal) {

44 const existing = getDeviceKey(principal);

45 if (existing !== void 0) return existing;

46 const minted = await holon.authorKeygen();

47 if (typeof minted.secret !== "string" || typeof minted.public !== "string") {

48 throw new Error("authorKeygen did not return a {secret, public} device key");

Lines 1136-1176javascript

1136async function secretSet(ws, secret, opts) {

1137 setSecret(cloudBase(opts.cloud), ws, secret);

1138 out3(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

1139 return 0;

1140

Source & flagged code

3 flagged · loading source

dist/cli.mjsView file

1156patternName = supabase_service_key severity = critical line = 1156 matchedText = DEFAULT_...SI";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.mjsView on unpkg · L1156

1156patternName = supabase_service_key severity = critical line = 1156 matchedText = DEFAULT_...SI";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.mjs

dist/cli.mjsView on unpkg · L1156

28async function clientConnect() { L29: const mod = await import("@githolon/client"); L30: return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L28

Findings

2 Critical4 Medium6 Low

CriticalCritical Secretdist/cli.mjs

CriticalSecret Patterndist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 8-48javascript

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/governance.ts

13var governance_exports = {};

14__export(governance_exports, {

15 governanceOffer: () => governanceOffer,

16 governanceRelay: () => governanceRelay,

17 grantOrRevoke: () => grantOrRevoke,

18 keyEnroll: () => keyEnroll,

19 keyExport: () => keyExport,

20 keyImport: () => keyImport,

21 keyShow: () => keyShow,

22 resolveGovernancePrincipal: () => resolveGovernancePrincipal,

23 signAndPostGovernance: () => signAndPostGovernance,

24 signAndPostOffer: () => signAndPostOffer

25});

26import { createHash, createPrivateKey, createPublicKey } from "node:crypto";

27import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";

28async function clientConnect() {

29 const mod = await import("@githolon/client");

30 return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L28

31}

32async function connectGovernance(cloud, parent) {

33 const authToken = await sessionToken().catch(() => void 0);

34 const clientId = `githolon-cli-${Date.now().toString(16)}`;

35 const connect = await clientConnect();

36 return await connect({

37 cloud,

38 workspace: parent,

39 clientId,

40 ...authToken !== void 0 ? { authToken } : {}

41 });

42}

43async function ensureDeviceKey(holon, principal) {

44 const existing = getDeviceKey(principal);

45 if (existing !== void 0) return existing;

46 const minted = await holon.authorKeygen();

47 if (typeof minted.secret !== "string" || typeof minted.public !== "string") {

48 throw new Error("authorKeygen did not return a {secret, public} device key");

Lines 1136-1176javascript

1136async function secretSet(ws, secret, opts) {

1137 setSecret(cloudBase(opts.cloud), ws, secret);

1138 out3(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

1139 return 0;

1140