registry / githolon / 0.55.1

githolon@0.55.1

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 263 KB of source, external domains: 127.0.0.1, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 8-48javascript

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/governance.ts

13var governance_exports = {};

14__export(governance_exports, {

15 governanceOffer: () => governanceOffer,

16 governanceRelay: () => governanceRelay,

17 grantOrRevoke: () => grantOrRevoke,

18 keyEnroll: () => keyEnroll,

19 keyExport: () => keyExport,

20 keyImport: () => keyImport,

21 keyShow: () => keyShow,

22 resolveGovernancePrincipal: () => resolveGovernancePrincipal,

23 signAndPostGovernance: () => signAndPostGovernance,

24 signAndPostOffer: () => signAndPostOffer

25});

26import { createHash, createPrivateKey, createPublicKey } from "node:crypto";

27import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";

28async function clientConnect() {

29 const mod = await import("@githolon/client");

30 return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L28

31}

32async function connectGovernance(cloud, parent) {

33 const authToken = await sessionToken().catch(() => void 0);

34 const clientId = `githolon-cli-${Date.now().toString(16)}`;

35 const connect = await clientConnect();

36 return await connect({

37 cloud,

38 workspace: parent,

39 clientId,

40 ...authToken !== void 0 ? { authToken } : {}

41 });

42}

43async function ensureDeviceKey(holon, principal) {

44 const existing = getDeviceKey(principal);

45 if (existing !== void 0) return existing;

46 const minted = await holon.authorKeygen();

47 if (typeof minted.secret !== "string" || typeof minted.public !== "string") {

48 throw new Error("authorKeygen did not return a {secret, public} device key");

Lines 1171-1211javascript

1171async function secretSet(ws, secret, opts) {

1172 setSecret(cloudBase(opts.cloud), ws, secret);

1173 out3(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

1174 return 0;

1175

Lines 1259-1299javascript

1259 process.stdout.write(`${res.path} already recommends the Nomos Law extension \u2014 nothing to do

1260`);

1261 } else {

1262 process.stdout.write(

1263 `${res.action} ${res.path} \u2014 VS Code will now suggest the Nomos Law extension when this project is opened

1264(install it from the marketplace, or search "Nomos Law"; it surfaces \`

Lines 4034-4074javascript

4034 const usdaBytes = new TextEncoder().encode(first.usda);

4035 writeFileSync8(usdaPath, usdaBytes);

4036 writeFileSync8(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));

4037 const s = first.stats;

4038 out11(` verify_chain ${

Source & flagged code

5 flagged · loading source

dist/cli.mjsView file

1191patternName = supabase_service_key severity = critical line = 1191 matchedText = DEFAULT_...SI";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.mjsView on unpkg · L1191

1191patternName = supabase_service_key severity = critical line = 1191 matchedText = DEFAULT_...SI";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.mjs

dist/cli.mjsView on unpkg · L1191

1279// src/compile.ts L1280: import { spawn, spawnSync } from "node:child_process"; L1281: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L1279

4054init_scene_projector(); L4055: out11 = (s) => void process.stdout.write(s + "\n"); L4056: err11 = (s) => void process.stderr.write("error: " + s + "\n"); ... L4062: import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "node:fs"; L4063: import { spawnSync as spawnSync5 } from "node:child_process"; L4064: import { createRequire as createRequire2 } from "node:module"; L4065: import { dirname as dirname7, join as join14, resolve as resolve4 } from "node:path"; L4066: import { pathToFileURL as pathToFileURL4 } from "node:url";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L4054

28async function clientConnect() { L29: const mod = await import("@githolon/client"); L30: return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L28

Findings

2 Critical3 High4 Medium6 Low

CriticalCritical Secretdist/cli.mjs

CriticalSecret Patterndist/cli.mjs

HighChild Processdist/cli.mjs

HighShell

HighCommand Output Exfiltrationdist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 8-48javascript

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/governance.ts

13var governance_exports = {};

14__export(governance_exports, {

15 governanceOffer: () => governanceOffer,

16 governanceRelay: () => governanceRelay,

17 grantOrRevoke: () => grantOrRevoke,

18 keyEnroll: () => keyEnroll,

19 keyExport: () => keyExport,

20 keyImport: () => keyImport,

21 keyShow: () => keyShow,

22 resolveGovernancePrincipal: () => resolveGovernancePrincipal,

23 signAndPostGovernance: () => signAndPostGovernance,

24 signAndPostOffer: () => signAndPostOffer

25});

26import { createHash, createPrivateKey, createPublicKey } from "node:crypto";

27import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";

28async function clientConnect() {

29 const mod = await import("@githolon/client");

30 return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L28

31}

32async function connectGovernance(cloud, parent) {

33 const authToken = await sessionToken().catch(() => void 0);

34 const clientId = `githolon-cli-${Date.now().toString(16)}`;

35 const connect = await clientConnect();

36 return await connect({

37 cloud,

38 workspace: parent,

39 clientId,

40 ...authToken !== void 0 ? { authToken } : {}

41 });

42}

43async function ensureDeviceKey(holon, principal) {

44 const existing = getDeviceKey(principal);

45 if (existing !== void 0) return existing;

46 const minted = await holon.authorKeygen();

47 if (typeof minted.secret !== "string" || typeof minted.public !== "string") {

48 throw new Error("authorKeygen did not return a {secret, public} device key");

Lines 1171-1211javascript

1171async function secretSet(ws, secret, opts) {

1172 setSecret(cloudBase(opts.cloud), ws, secret);

1173 out3(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

1174 return 0;

1175

Lines 1259-1299javascript

1259 process.stdout.write(`${res.path} already recommends the Nomos Law extension \u2014 nothing to do

1260`);

1261 } else {

1262 process.stdout.write(

1263 `${res.action} ${res.path} \u2014 VS Code will now suggest the Nomos Law extension when this project is opened

1264(install it from the marketplace, or search "Nomos Law"; it surfaces \`

Lines 4034-4074javascript

4034 const usdaBytes = new TextEncoder().encode(first.usda);

4035 writeFileSync8(usdaPath, usdaBytes);

4036 writeFileSync8(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));

4037 const s = first.stats;

4038 out11(` verify_chain ${