pkg.sopackage field notes

security

Package publisher tools

Package publishing tools can use registry tokens, sign artifacts, and push releases from an agent-controlled shell.

summary

Why this package group is here

Package publisher tools currently includes 225 package catalog entries. 0 have protected-tool coverage, 3 have approval-gate metadata, and 69 have non-low Geiger classifier findings. The grouping comes from package metadata, so it can stay current as that metadata changes.

Generated source

This hub uses the same local package data as individual package pages: Nucleus package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.

Review model

Use the hub to find command families that need tighter secret injection, approval gates, or manual review before agents run them.

High-signal tools

node7 approval-gate rules are present.go7 approval-gate rules are present.uv6 approval-gate rules are present.rubydoc example: interpreter runtimecreate-dmggeneralized runtime or code generation signalportable-rubygeneralized runtime or code generation signaldubgeneralized runtime or code generation signalbuild2generalized runtime or code generation signalcargo-makegeneralized runtime or code generation signalopalgeneralized runtime or code generation signalrustnarrow executable package without higher-risk signalsruby-buildInstall various Ruby versions and implementations

Approval-gated tools

node7 approval-gate rules are present.go7 approval-gate rules are present.uv6 approval-gate rules are present.

Related hubs

Homebrew utility packagesHomebrew packages with local package pages that need at least one crawlable package-graph path.224Terminal utility packagesCommand-line utilities with local package pages, executable metadata, and Automic Vault security notes.223Package ecosystem packagesPackages that install, publish, inspect, or automate other package ecosystems.203Developer build packagesBuild systems, compilers, generators, and developer tools that influence local source trees and artifacts.179Text processing packagesPackages used to inspect, transform, search, render, or generate text and structured documents.175Web development packagesWeb servers, frontend build tools, JavaScript packages, CSS tools, and browser-adjacent utilities.175Language runtime packagesLanguage runtimes, package ecosystems, and interpreter-adjacent packages.159Secret-risk packagesPackages with protected-tool coverage, approval-gate metadata, or non-low Geiger findings deserve explicit review before agents run them.70

Representative package spokes

node7 approval-gate rules are present.0x🔥 single-command flamegraph profiling 🔥uv6 approval-gate rules are present.go7 approval-gate rules are present.rubydoc example: interpreter runtimepnpminfrastructure mutation or orchestration signalhelmKubernetes package managerrustnarrow executable package without higher-risk signalsruby-buildInstall various Ruby versions and implementationsmintinfrastructure mutation or orchestration signalcomposerinfrastructure mutation or orchestration signalrbenvinfrastructure mutation or orchestration signalpoetryPython package management toolyarnpackage manager and supply-chain mutatororasnarrow executable package without higher-risk signalsrustupRust toolchain installer

packages

Indexed package pages

PackageManagerSignalsWhy it appears here
nodeHomebrewapproval gate, yellow risk, v26.5.17 approval-gate rules are present.
goHomebrewapproval gate, yellow risk, v1.26.57 approval-gate rules are present.
uvHomebrewapproval gate, v0.12.16 approval-gate rules are present.
rubyHomebrewyellow risk, v4.0.6doc example: interpreter runtime
create-dmgHomebrewyellow risk, v1.3.0generalized runtime or code generation signal
portable-rubyHomebrewyellow risk, v4.0.6generalized runtime or code generation signal
dubHomebrewyellow risk, v1.41.0generalized runtime or code generation signal
build2Homebrewyellow risk, v0.18.1generalized runtime or code generation signal
cargo-makeHomebrewyellow risk, v0.37.24generalized runtime or code generation signal
opalHomebrewyellow risk, v1.8.3generalized runtime or code generation signal
rustHomebrewgreen risk, v1.97.1narrow executable package without higher-risk signals
ruby-buildHomebrewv20260716no executable entrypoint in the package index
poetryHomebrewv2.4.1no executable entrypoint in the package index
orasHomebrewgreen risk, v1.3.3narrow executable package without higher-risk signals
rustupHomebrewv1.29.0no executable entrypoint in the package index
virtualenvHomebrewv21.7.1no executable entrypoint in the package index
pipenvHomebrewgreen risk, v2026.6.2narrow executable package without higher-risk signals
goreleaserHomebrewgreen risk, v2.17.1narrow executable package without higher-risk signals
pixiHomebrewv0.75.0no executable entrypoint in the package index
ruby-installHomebrewgreen risk, v0.10.2narrow executable package without higher-risk signals
cargo-binstallHomebrewgreen risk, v1.21.1narrow executable package without higher-risk signals
asciidoctorHomebrewgreen risk, v2.0.26narrow executable package without higher-risk signals
cargo-cHomebrewgreen risk, v0.10.24narrow executable package without higher-risk signals
onigmoHomebrewgreen risk, v6.2.0library-like package without higher-risk signals
dpkgHomebrewgreen risk, v1.23.7narrow executable package without higher-risk signals
cpanminusHomebrewgreen risk, v1.7049narrow executable package without higher-risk signals
rpmHomebrewv6.0.2no executable entrypoint in the package index
tmuxinatorHomebrewgreen risk, v3.4.1narrow executable package without higher-risk signals
vcpkgHomebrewgreen risk, v2026-07-27library-like package without higher-risk signals
maturinHomebrewv1.14.1no executable entrypoint in the package index
chrubyHomebrewgreen risk, v0.3.9narrow executable package without higher-risk signals
lolcatHomebrewgreen risk, v100.0.1narrow executable package without higher-risk signals
mrubyHomebrewgreen risk, v4.0.0narrow executable package without higher-risk signals
hatchHomebrewv1.17.1no executable entrypoint in the package index
cargo-nextestHomebrewv0.9.140no executable entrypoint in the package index
npm-check-updatesHomebrewv23.0.0no executable entrypoint in the package index
brew-gemHomebrewv1.3.4no executable entrypoint in the package index
melangeHomebrewv0.56.4no executable entrypoint in the package index
python-buildHomebrewgreen risk, v1.5.1narrow executable package without higher-risk signals
skillsHomebrewv1.5.21no executable entrypoint in the package index
nfpmHomebrewgreen risk, v2.47.0narrow executable package without higher-risk signals
mdlessHomebrewv2.1.68no executable entrypoint in the package index
twineHomebrewv7.0.0no executable entrypoint in the package index
x-cmdHomebrewv0.10.0no executable entrypoint in the package index
regclientHomebrewv0.11.5no executable entrypoint in the package index
cargo-editHomebrewgreen risk, v0.13.13narrow executable package without higher-risk signals
mcpmHomebrewv2.15.0no executable entrypoint in the package index
wasm-packHomebrewv0.15.0no executable entrypoint in the package index
mcp-publisherHomebrewv1.8.0no executable entrypoint in the package index
npqHomebrewv3.23.3no executable entrypoint in the package index
solargraphHomebrewv0.60.2no executable entrypoint in the package index
msitoolsHomebrewgreen risk, v0.106narrow executable package without higher-risk signals
rbspyHomebrewv0.51.0no executable entrypoint in the package index
ansible-language-serverHomebrewv26.6.0no executable entrypoint in the package index
vsceHomebrewgreen risk, v3.9.2narrow executable package without higher-risk signals
rubyfmtHomebrewv0.14.1no executable entrypoint in the package index
cargo-updateHomebrewgreen risk, v22.1.1narrow executable package without higher-risk signals
fakerootHomebrewv2.1.4no executable entrypoint in the package index
cargo-auditHomebrewgreen risk, v0.22.2narrow executable package without higher-risk signals
cargo-sweepHomebrewgreen risk, v0.8.0narrow executable package without higher-risk signals
cargo-denyHomebrewv0.20.2no executable entrypoint in the package index
rbenv-gemsetHomebrewgreen risk, v0.5.102narrow executable package without higher-risk signals
passengerHomebrewv6.1.8no executable entrypoint in the package index
conda-lockHomebrewv4.0.2no executable entrypoint in the package index
cargo-llvm-covHomebrewv0.8.7no executable entrypoint in the package index
cargo-udepsHomebrewgreen risk, v0.1.61narrow executable package without higher-risk signals
jrubyHomebrewgreen risk, v10.1.1.0narrow executable package without higher-risk signals
nuitkaHomebrewv4.1.3no executable entrypoint in the package index
cargo-outdatedHomebrewgreen risk, v0.19.0narrow executable package without higher-risk signals
youplotHomebrewgreen risk, v0.5.0narrow executable package without higher-risk signals
cargo-zigbuildHomebrewgreen risk, v0.23.0narrow executable package without higher-risk signals
cargo-instrumentsHomebrewv0.4.17no executable entrypoint in the package index