registry / githolon / 0.73.0

githolon@0.73.0

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 425 KB of source, external domains: 127.0.0.1, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk, unborn.invalid

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 2857-2897javascript

2857 }

2858 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2859 return { kind, stableIds: [...sids], raw };

2860}

2861function matchRepair(refusal, repairs) {

2862 if (refusal.kind === "other") return void 0;

2863 return repairs.find(

2864 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2865 );

2866}

2867function knownRepairBlock(repair) {

2868 return [

2869 "",

2870 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2871 ` reason: ${repair.reason}`,

2872 " Re-run with --repair to execute it."

2873 ].join("\n");

2874}

2875function resolveTsxCli(cwd) {

2876 const pkgDir = (name, fromDir) => {

2877 try {

2878 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2879 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2877

2880 return void 0;

2881 }

2882 };

2883 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2884 try {

2885 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

2886 } catch {

2887 return void 0;

2888 }

2889 })();

2890 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

2891 if (tsxDir === void 0) return void 0;

2892 try {

2893 const pkg = JSON.parse(

2894 readFileSync2(join3(tsxDir, "package.json"), "utf8")

2895 );

2896 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

2897 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5109-5149javascript

5109async function secretSet(ws, secret, opts) {

5110 setSecret(cloudBase(opts.cloud), ws, secret);

5111 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

5112 return 0;

5113

Source & flagged code

3 flagged · loading source

dist/cli.mjsView file

5129patternName = supabase_service_key severity = critical line = 5129 matchedText = DEFAULT_...SI";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.mjsView on unpkg · L5129

5129patternName = supabase_service_key severity = critical line = 5129 matchedText = DEFAULT_...SI";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.mjs

dist/cli.mjsView on unpkg · L5129

2877try { L2878: return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`)); L2879: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2877

Findings

2 Critical4 Medium6 Low

CriticalCritical Secretdist/cli.mjs

CriticalSecret Patterndist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 2857-2897javascript

2857 }

2858 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2859 return { kind, stableIds: [...sids], raw };

2860}

2861function matchRepair(refusal, repairs) {

2862 if (refusal.kind === "other") return void 0;

2863 return repairs.find(

2864 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2865 );

2866}

2867function knownRepairBlock(repair) {

2868 return [

2869 "",

2870 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2871 ` reason: ${repair.reason}`,

2872 " Re-run with --repair to execute it."

2873 ].join("\n");

2874}

2875function resolveTsxCli(cwd) {

2876 const pkgDir = (name, fromDir) => {

2877 try {

2878 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2879 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2877

2880 return void 0;

2881 }

2882 };

2883 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2884 try {

2885 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

2886 } catch {

2887 return void 0;

2888 }

2889 })();

2890 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

2891 if (tsxDir === void 0) return void 0;

2892 try {

2893 const pkg = JSON.parse(

2894 readFileSync2(join3(tsxDir, "package.json"), "utf8")

2895 );

2896 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

2897 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5109-5149javascript

5109async function secretSet(ws, secret, opts) {

5110 setSecret(cloudBase(opts.cloud), ws, secret);

5111 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

5112 return 0;

5113