registry / githolon / 0.65.1

githolon@0.65.1

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 364 KB of source, external domains: 127.0.0.1, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 2707-2747javascript

2707 }

2708});

2709

2710// src/governance.ts

2711var governance_exports = {};

2712__export(governance_exports, {

2713 certifyEra: () => certifyEra,

2714 governanceOffer: () => governanceOffer,

2715 governanceRelay: () => governanceRelay,

2716 grantOrRevoke: () => grantOrRevoke,

2717 keyEnroll: () => keyEnroll,

2718 keyExport: () => keyExport,

2719 keyImport: () => keyImport,

2720 keyShow: () => keyShow,

2721 resolveGovernancePrincipal: () => resolveGovernancePrincipal,

2722 signAndPostGovernance: () => signAndPostGovernance,

2723 signAndPostOffer: () => signAndPostOffer

2724});

2725import { createHash, createPrivateKey, createPublicKey } from "node:crypto";

2726import { readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";

2727async function clientConnect() {

2728 const mod = await import("@githolon/client");

2729 return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2727

2730}

2731async function connectGovernance(cloud, parent) {

2732 const authToken = await sessionToken().catch(() => void 0);

2733 const clientId = `githolon-cli-${Date.now().toString(16)}`;

2734 const connect = await clientConnect();

2735 return await connect({

2736 cloud,

2737 workspace: parent,

2738 clientId,

2739 ...authToken !== void 0 ? { authToken } : {}

2740 });

2741}

2742async function ensureDeviceKey(holon, principal) {

2743 const existing = getDeviceKey(principal);

2744 if (existing !== void 0) return existing;

2745 const minted = await holon.authorKeygen();

2746 if (typeof minted.secret !== "string" || typeof minted.public !== "string") {

2747 throw new Error("authorKeygen did not return a {secret, public} device key");

Lines 3028-3068javascript

3028 if (!r.ok) {

3029 err2(`${directiveId} refused (${r.status}): ${text}`);

3030 return 1;

3031 }

3032 let head;

3033 try {

3034 head = JSON

Lines 4003-4043javascript

4003async function secretSet(ws, secret, opts) {

4004 setSecret(cloudBase(opts.cloud), ws, secret);

4005 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

4006 return 0;

4007

Lines 6224-6264javascript

6224 const usdaBytes = new TextEncoder().encode(first.usda);

6225 writeFileSync8(usdaPath, usdaBytes);

6226 writeFileSync8(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));

6227 const s = first.stats;

6228 out11(` verify_chain ${

Source & flagged code

5 flagged · loading source

dist/cli.mjsView file

4023patternName = supabase_service_key severity = critical line = 4023 matchedText = DEFAULT_...SI";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.mjsView on unpkg · L4023

4023patternName = supabase_service_key severity = critical line = 4023 matchedText = DEFAULT_...SI";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.mjs

dist/cli.mjsView on unpkg · L4023

3048try { L3049: const { execFileSync } = await import("node:child_process"); L3050: seed = execFileSync("gcloud", ["secrets", "versions", "access", "latest", "--secret", opts.gcpSecret], { encoding: "utf8" }).trim();

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L3048

6244init_scene_projector(); L6245: out11 = (s) => void process.stdout.write(s + "\n"); L6246: err11 = (s) => void process.stderr.write("error: " + s + "\n"); ... L6252: import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "node:fs"; L6253: import { spawnSync as spawnSync5 } from "node:child_process"; L6254: import { createRequire as createRequire2 } from "node:module"; L6255: import { dirname as dirname7, join as join14, resolve as resolve4 } from "node:path"; L6256: import { pathToFileURL as pathToFileURL4 } from "node:url";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L6244

2727async function clientConnect() { L2728: const mod = await import("@githolon/client"); L2729: return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2727

Findings

2 Critical3 High4 Medium6 Low

CriticalCritical Secretdist/cli.mjs

CriticalSecret Patterndist/cli.mjs

HighChild Processdist/cli.mjs

HighShell

HighCommand Output Exfiltrationdist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 2707-2747javascript

2707 }

2708});

2709

2710// src/governance.ts

2711var governance_exports = {};

2712__export(governance_exports, {

2713 certifyEra: () => certifyEra,

2714 governanceOffer: () => governanceOffer,

2715 governanceRelay: () => governanceRelay,

2716 grantOrRevoke: () => grantOrRevoke,

2717 keyEnroll: () => keyEnroll,

2718 keyExport: () => keyExport,

2719 keyImport: () => keyImport,

2720 keyShow: () => keyShow,

2721 resolveGovernancePrincipal: () => resolveGovernancePrincipal,

2722 signAndPostGovernance: () => signAndPostGovernance,

2723 signAndPostOffer: () => signAndPostOffer

2724});

2725import { createHash, createPrivateKey, createPublicKey } from "node:crypto";

2726import { readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";

2727async function clientConnect() {

2728 const mod = await import("@githolon/client");

2729 return mod.connect;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2727

2730}

2731async function connectGovernance(cloud, parent) {

2732 const authToken = await sessionToken().catch(() => void 0);

2733 const clientId = `githolon-cli-${Date.now().toString(16)}`;

2734 const connect = await clientConnect();

2735 return await connect({

2736 cloud,

2737 workspace: parent,

2738 clientId,

2739 ...authToken !== void 0 ? { authToken } : {}

2740 });

2741}

2742async function ensureDeviceKey(holon, principal) {

2743 const existing = getDeviceKey(principal);

2744 if (existing !== void 0) return existing;

2745 const minted = await holon.authorKeygen();

2746 if (typeof minted.secret !== "string" || typeof minted.public !== "string") {

2747 throw new Error("authorKeygen did not return a {secret, public} device key");

Lines 3028-3068javascript

3028 if (!r.ok) {

3029 err2(`${directiveId} refused (${r.status}): ${text}`);

3030 return 1;

3031 }

3032 let head;

3033 try {

3034 head = JSON

Lines 4003-4043javascript

4003async function secretSet(ws, secret, opts) {

4004 setSecret(cloudBase(opts.cloud), ws, secret);

4005 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

4006 return 0;

4007

Lines 6224-6264javascript

6224 const usdaBytes = new TextEncoder().encode(first.usda);

6225 writeFileSync8(usdaPath, usdaBytes);

6226 writeFileSync8(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));

6227 const s = first.stats;

6228 out11(` verify_chain ${