registry / githolon / 0.83.0

githolon@0.83.0

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 531 KB of source, external domains: 127.0.0.1, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk, unborn.invalid

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 2891-2931javascript

2891 }

2892 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2893 return { kind, stableIds: [...sids], raw };

2894}

2895function matchRepair(refusal, repairs) {

2896 if (refusal.kind === "other") return void 0;

2897 return repairs.find(

2898 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2899 );

2900}

2901function knownRepairBlock(repair) {

2902 return [

2903 "",

2904 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2905 ` reason: ${repair.reason}`,

2906 " Re-run with --repair to execute it."

2907 ].join("\n");

2908}

2909function resolveTsxCli(cwd) {

2910 const pkgDir = (name, fromDir) => {

2911 try {

2912 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2913 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2911

2914 return void 0;

2915 }

2916 };

2917 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2918 try {

2919 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

2920 } catch {

2921 return void 0;

2922 }

2923 })();

2924 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

2925 if (tsxDir === void 0) return void 0;

2926 try {

2927 const pkg = JSON.parse(

2928 readFileSync2(join3(tsxDir, "package.json"), "utf8")

2929 );

2930 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

2931 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5268-5308javascript

5268async function secretSet(ws, secret, opts) {

5269 setSecret(cloudBase(opts.cloud), ws, secret);

5270 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

5271 return 0;

5272

dist/dev-server.mjsView file

Lines 24-64javascript

24 return rel === "" ? [] : rel.split("/");

25 }

26 function resolve(ps) {

27 let cur = root;

28 for (const part

Source & flagged code

5 flagged · loading source

dist/cli.mjsView file

5288patternName = supabase_service_key severity = critical line = 5288 matchedText = DEFAULT_...SI";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.mjsView on unpkg · L5288

5288patternName = supabase_service_key severity = critical line = 5288 matchedText = DEFAULT_...SI";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.mjs

dist/cli.mjsView on unpkg · L5288

2911try { L2912: return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`)); L2913: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2911

dist/dev-server.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = githolon@0.82.0 matchedIdentity = npm:Z2l0aG9sb24:0.82.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dev-server.mjsView on unpkg

44const encoding = typeof opts === "string" ? opts : opts && opts.encoding; L45: return encoding ? new TextDecoder().decode(data) : new Uint8Array(data); L46: }, ... L193: async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) { L194: const r = await fetch(`${remote}/info/refs?service=${service}`, { headers }); L195: if (!r.ok) { ... L230: headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers }, L231: body: concatBytes(parts) L232: }); ... L328: // ../adapter/engine.mjs L329: import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim"; L330: function b64Bytes(bytes) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dev-server.mjsView on unpkg · L44

Findings

2 Critical1 High4 Medium7 Low

CriticalCritical Secretdist/cli.mjs

CriticalSecret Patterndist/cli.mjs

HighPrevious Version Dangerous Deltadist/dev-server.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/dev-server.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 2891-2931javascript

2891 }

2892 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2893 return { kind, stableIds: [...sids], raw };

2894}

2895function matchRepair(refusal, repairs) {

2896 if (refusal.kind === "other") return void 0;

2897 return repairs.find(

2898 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2899 );

2900}

2901function knownRepairBlock(repair) {

2902 return [

2903 "",

2904 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2905 ` reason: ${repair.reason}`,

2906 " Re-run with --repair to execute it."

2907 ].join("\n");

2908}

2909function resolveTsxCli(cwd) {

2910 const pkgDir = (name, fromDir) => {

2911 try {

2912 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2913 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2911

2914 return void 0;

2915 }

2916 };

2917 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2918 try {

2919 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

2920 } catch {

2921 return void 0;

2922 }

2923 })();

2924 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

2925 if (tsxDir === void 0) return void 0;

2926 try {

2927 const pkg = JSON.parse(

2928 readFileSync2(join3(tsxDir, "package.json"), "utf8")

2929 );

2930 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

2931 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5268-5308javascript

5268async function secretSet(ws, secret, opts) {

5269 setSecret(cloudBase(opts.cloud), ws, secret);

5270 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

5271 return 0;

5272

dist/dev-server.mjsView file

Lines 24-64javascript

24 return rel === "" ? [] : rel.split("/");

25 }

26 function resolve(ps) {

27 let cur = root;

28 for (const part