noxid-cli 0.2.1

The Noxid compiler command line: check, build, test, adapt, and the agent surface
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# Vetting record: postgres

package: postgres
version: 3.4.9
integrity: sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw==
verdict: REJECT-OR-JUSTIFY
reviewed-by: Claude (evaluator) with tools/npm-vet.mjs stage 1
date: 2026-08-28

## Justifications

One high finding: a `prepare: npm run build` lifecycle script.
Justified: `prepare` runs only when packing from source or installing
from git - a registry tarball install never executes a dependency's
prepare script - and this repository additionally pins
`ignore-scripts=true` in .npmrc, so it is inert twice over. The
remaining finding is the author's homepage URL in package.json (inert
text). Zero runtime dependencies, 37 files, no credential/process/eval
markers. Provenance is not attested (the author does not publish
attestations); mitigated by the exact integrity pin above, which the
admission gate verifies against the lockfile on every build.

## Stage-1 report

```json
{
  "package": "postgres@3.4.9",
  "integrity": "sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw==",
  "provenance": "none",
  "filesScanned": 37,
  "findings": [
    {
      "severity": "high",
      "kind": "install-script",
      "detail": "prepare: npm run build"
    },
    {
      "severity": "low",
      "kind": "external-url",
      "detail": "package.json: https://www.porsager.com"
    }
  ],
  "notes": [
    "resolved postgres@3.4.9, integrity sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw=="
  ],
  "sandbox": null,
  "verdict": "REJECT-OR-JUSTIFY"
}
```