frankennode
<div align="center" <img src="docs/assets/frankennodeillustration.webp" alt="frankennode - trust-native JavaScript and TypeScript runtime platform" </div
<div align="center"
[](https://github.com/Dicklesworthstone/frankennode/actions/workflows/readme-quick-example-smoke.yml) [](https://github.com/Dicklesworthstone/frankennode/actions/workflows/verifier-sdk-standalone.yml)
</div
franken-node is a trust-native JavaScript/TypeScript runtime platform for extension-heavy systems. It pairs Node/Bun ecosystem velocity with deterministic security controls, cryptographically-grounded trust operations, and replayable incident forensics.
# One-line installer (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/franken_node/main/install.sh | bash[!IMPORTANT] Status: pre-1.0. The CLI surface and the on-the-wire JSON shapes (decision receipts, trust cards, replay verdicts, counterfactual reports, incident bundles) are stable and covered by golden tests. Internal Rust APIs and feature-gated modules may still break between versions. See Stability for the full breakdown.
---
A concrete scenario
It's Tuesday. A transitive npm dependency in your build was published 14 days ago by a brand-new publisher whose username is 2 characters off a popular library. The package's behavior has slowly drifted in the last three minor releases.
Under your current stack: the typosquat scanner flags it tomorrow; your package-lock pinned the new version yesterday; the egress check runs at deploy time and sees nothing wrong because the malicious payload activates after a 48-hour delay. By Friday you're paging the security team.
Under franken-node:
- trust scan --deep reads the package's npm registry record and writes
onto its trust card that the package was first published 14 days ago (new packages are raised to at least medium risk), plus a DGIS maintainer-fragility score (sole maintainer, no maintainers, no publish in over a year). A package name one edit away from a pinned popular package is raised to high risk. This happens before the package is admitted. The scan does not see publisher account age (npm does not publish it) or a look-alike publisher username.
- Behavior drift across releases is not yet on the card: the BPET
camouflage detector (security::bpet::camouflagedetector) can flag GradualCreep in an observed-vs-declared capability series, but no runtime path feeds it yet, so camouflagehints stays empty.
- Under strict, run refuses a trusted dependency, and so the