registry / githolon / 0.98.2

githolon@0.98.2

githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 597 KB of source, external domains: 127.0.0.1, dev-idp.local, kjbcjkihxskuwwfdqklt.supabase.co, nomos.captainapp.co.uk, unborn.invalid

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 2965-3005javascript

2965 }

2966 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2967 return { kind, stableIds: [...sids], raw };

2968}

2969function matchRepair(refusal, repairs) {

2970 if (refusal.kind === "other") return void 0;

2971 return repairs.find(

2972 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2973 );

2974}

2975function knownRepairBlock(repair) {

2976 return [

2977 "",

2978 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2979 ` reason: ${repair.reason}`,

2980 " Re-run with --repair to execute it."

2981 ].join("\n");

2982}

2983function resolveTsxCli(cwd) {

2984 const pkgDir = (name, fromDir) => {

2985 try {

2986 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2987 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2985

2988 return void 0;

2989 }

2990 };

2991 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2992 try {

2993 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

2994 } catch {

2995 return void 0;

2996 }

2997 })();

2998 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

2999 if (tsxDir === void 0) return void 0;

3000 try {

3001 const pkg = JSON.parse(

3002 readFileSync2(join3(tsxDir, "package.json"), "utf8")

3003 );

3004 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

3005 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5492-5532javascript

5492async function secretSet(ws, secret, opts) {

5493 setSecret(cloudBase(opts.cloud), ws, secret);

5494 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

5495 return 0;

5496

dist/dev-server.mjsView file

Lines 24-64javascript

24 return rel === "" ? [] : rel.split("/");

25 }

26 function resolve(ps) {

27 let cur = root;

28 for (const part

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

5512patternName = supabase_service_key severity = critical line = 5512 matchedText = DEFAULT_...SI";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.mjsView on unpkg · L5512

5512patternName = supabase_service_key severity = critical line = 5512 matchedText = DEFAULT_...SI";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.mjs

dist/cli.mjsView on unpkg · L5512

2985try { L2986: return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`)); L2987: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2985

dist/dev-server.mjsView file

44const encoding = typeof opts === "string" ? opts : opts && opts.encoding; L45: return encoding ? new TextDecoder().decode(data) : new Uint8Array(data); L46: }, ... L195: async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) { L196: const r = await fetch(`${remote}/info/refs?service=${service}`, { headers }); L197: if (!r.ok) { ... L232: headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers }, L233: body: concatBytes(parts) L234: }); ... L331: // ../adapter/engine.ts L332: import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim"; L333: function b64Bytes(bytes) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dev-server.mjsView on unpkg · L44

Findings

2 Critical4 Medium7 Low

CriticalCritical Secretdist/cli.mjs

CriticalSecret Patterndist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/dev-server.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 2965-3005javascript

2965 }

2966 for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());

2967 return { kind, stableIds: [...sids], raw };

2968}

2969function matchRepair(refusal, repairs) {

2970 if (refusal.kind === "other") return void 0;

2971 return repairs.find(

2972 (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())

2973 );

2974}

2975function knownRepairBlock(repair) {

2976 return [

2977 "",

2978 `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,

2979 ` reason: ${repair.reason}`,

2980 " Re-run with --repair to execute it."

2981 ].join("\n");

2982}

2983function resolveTsxCli(cwd) {

2984 const pkgDir = (name, fromDir) => {

2985 try {

2986 return dirname2(createRequire(pathToFileURL(join3(fromDir, "noop.js")).href).resolve(`${name}/package.json`));

2987 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L2985

2988 return void 0;

2989 }

2990 };

2991 const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {

2992 try {

2993 return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));

2994 } catch {

2995 return void 0;

2996 }

2997 })();

2998 const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);

2999 if (tsxDir === void 0) return void 0;

3000 try {

3001 const pkg = JSON.parse(

3002 readFileSync2(join3(tsxDir, "package.json"), "utf8")

3003 );

3004 const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];

3005 return join3(tsxDir, rel ?? "dist/cli.mjs");

Lines 5492-5532javascript

5492async function secretSet(ws, secret, opts) {

5493 setSecret(cloudBase(opts.cloud), ws, secret);

5494 out4(`\u2713 git push password for ${ws} saved \u2192 ${credsPath()} (used by the push-to-create birth lane)`);

5495 return 0;

5496

dist/dev-server.mjsView file

Lines 24-64javascript

24 return rel === "" ? [] : rel.split("/");

25 }

26 function resolve(ps) {

27 let cur = root;

28 for (const part