← Browse the report library

a public repository, read by nittim

Crosstalk-Solutions/project-nomad security audit

What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.

Project NOMAD is an offline-first knowledge and education server. Wikipedia, thousands of books, courses, maps, and optional local AI, all running on hardware you own with no internet required.

TypeScript · 42.4k stars · last push November 6, 2026

Crosstalk-Solutions/project-nomad is a TypeScript repository that provides an offline-first knowledge and education server. The project bundles Wikipedia, books, courses, maps, and optional local AI to run on personal hardware without requiring internet connectivity.

The scan of Crosstalk-Solutions/project-nomad read 625 files and found evidence of concern. One committed credential was detected on a production path. The scan identified 25 vulnerable runtime dependencies across the codebase. GHSA-qxc2-j82w-r537 in @faker-js/faker, GHSA-m9gg-hp2v-232j in @grpc/grpc-js, GHSA-g2v6-rqmx-r4w6 in @vue/server-renderer, GHSA-27p8-2357-5qqv and GHSA-4w3w-2rp5-g8jm in @xmldom/xmldom, GHSA-3pq3-5fj3-cg6v in axios, GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx in browserslist, GHSA-vc2v-76pw-4v95 in compression, GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p and GHSA-q3jh-wrc6-jgq8 in follow-redirects, GHSA-hmw2-7cc7-3qxx in form-data, GHSA-jrc7-96c5-q579 in maplibre-gl,

Written from nittim's own scan on November 7, 2026; rescanned when the repository changes.

No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.

What was read — rule-based scan

Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.

Read 625 of 625 eligible files. Commit 54ee30a. 2026-11-07.

What the scanners found

Committed secrets on production paths
1
Vulnerable runtime dependencies
25

@faker-js/faker (GHSA-qxc2-j82w-r537), @grpc/grpc-js (GHSA-m9gg-hp2v-232j), @vue/server-renderer (GHSA-g2v6-rqmx-r4w6), @xmldom/xmldom (GHSA-27p8-2357-5qqv, GHSA-4w3w-2rp5-g8jm), axios (GHSA-3pq3-5fj3-cg6v), browserslist (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx), compression (GHSA-vc2v-76pw-4v95), follow-redirects (GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8), form-data (GHSA-hmw2-7cc7-3qxx), maplibre-gl (GHSA-jrc7-96c5-q579), nanoid (GHSA-28wg-ghj8-5hjv), postcss (GHSA-r28c-9q8g-f849), proxy-addr (GHSA-jqcg-44mw-7w3h), sharp (GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w), source-map-js (GHSA-68fv-2mgg-jv7q), systeminformation (GHSA-3f7j-7jwc-fxfj), tar (GHSA-23hp-3jrh-7fpw, GHSA-8x88-c5mf-7j5w)

Run it yourself

Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.

Scan your own repo

Questions

What did nittim read in Crosstalk-Solutions/project-nomad?
nittim read 625 of 625 eligible files in Crosstalk-Solutions/project-nomad. The reading ran on November 7, 2026. It was taken at commit 54ee30a.
Did nittim find committed secrets or vulnerable dependencies in Crosstalk-Solutions/project-nomad?
The rule-based scan found 1 committed secret and 25 vulnerable dependencies in Crosstalk-Solutions/project-nomad. Affected: @faker-js/faker (GHSA-qxc2-j82w-r537), @grpc/grpc-js (GHSA-m9gg-hp2v-232j), @vue/server-renderer (GHSA-g2v6-rqmx-r4w6), @xmldom/xmldom (GHSA-27p8-2357-5qqv, GHSA-4w3w-2rp5-g8jm), axios (GHSA-3pq3-5fj3-cg6v), browserslist (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx), compression (GHSA-vc2v-76pw-4v95), follow-redirects (GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8), form-data (GHSA-hmw2-7cc7-3qxx), maplibre-gl (GHSA-jrc7-96c5-q579), nanoid (GHSA-28wg-ghj8-5hjv), postcss (GHSA-r28c-9q8g-f849), proxy-addr (GHSA-jqcg-44mw-7w3h), sharp (GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w), source-map-js (GHSA-68fv-2mgg-jv7q), systeminformation (GHSA-3f7j-7jwc-fxfj), tar (GHSA-23hp-3jrh-7fpw, GHSA-8x88-c5mf-7j5w).
Is Crosstalk-Solutions/project-nomad production ready?
A free scan is not a verdict. A full audit gives one.

More like this

More TypeScript repositories →

Add the badge to your README
README badge
nittim verdict badge for Crosstalk-Solutions/project-nomad[![nittim](https://nittim.com/api/badge/Crosstalk-Solutions/project-nomad)](https://nittim.com/library/Crosstalk-Solutions/project-nomad)