github.com / crosstalk-solutions

crosstalk-solutions/project-nomad

TypeScript·520 files·commit 85da928·scanned 2h ago·cached ✓

12/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

38,356 stars

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.admin/scripts/audit_catalog_ports.py

def sh(cmd):
    return subprocess.run(cmd, shell=True, capture_output=True, text=True)

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoSuspicious file in repoVery large source file (713KB) — could contain obfuscated payloadadmin/package-lock.json+2

infoAuthor has no other public repositoriesGitHub user "cosmistack-bot" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

451 files scanned @ 85da928 | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution6

network & exfiltration0

file system access0

obfuscation0

supply chain4

owasp / injection0

telemetry

files 451/520rules hit 4engine v6commit 85da928

github

crosstalk-solutions/project-nomad

Project NOMAD is an offline-first knowledge and education server. Wikipedia, thousands of books, courses, maps, and optional local AI, all running on hardware you own with no internet required.

TypeScript

38356

3808

458d

520 files

451 scanned(87%)

85da928

architecture░▒▓

entry (1) flagged (1) pkg (347)

747 nodes · 1661 edgesscroll to zoom · click node to jump to finding