registry / @alicloud/polardb20170801 / 7.5.0

@alicloud/polardb20170801@7.5.0

English | [简体中文](README-CN.md) ![](https://aliyunsdk-pages.alicdn.com/icons/AlibabaCloud.svg)

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a generated PolarDB API client that makes authenticated service calls only when its consumer invokes client methods.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer constructs Client and calls a PolarDB API method.

Impact

Normal user-directed PolarDB management operations.

Mechanism

Serialize caller-provided request fields into authenticated OpenAPI calls.

Rationale

Static inspection supports a normal auto-generated Alibaba Cloud PolarDB SDK. The scanner's secret signal is attributable to declarative API request fields, not harvesting, embedded secrets, or exfiltration.

Evidence

package.jsonsrc/client.tssrc/models/CreateAidbclusterRequest.tsdist/client.jsdist/models/CreateAidbclusterRequest.js

Network endpoints3

polardb.aliyuncs.compolardb.us-west-1.aliyuncs.compolardb.us-east-1.aliyuncs.com

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

`CreateAIDBClusterRequest` defines user-supplied password and Kubernetes config fields.
Client methods can invoke PolarDB API actions after explicit caller requests.

Evidence against

`package.json` has no preinstall/install/postinstall/prepare hook; prepublishOnly only runs tsc.
`src/client.ts` is generated SDK code extending `@alicloud/openapi-core`.
Source contains no child-process, filesystem, environment harvesting, eval, or dynamic-import primitives.
`CreateAidbclusterRequest` is a declarative request model; its secret-like fields are not embedded credentials.
Network targets are configured PolarDB `aliyuncs.com` service endpoints and calls occur in API methods.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2,592 file(s), 8.65 MB of source

Source & flagged code

6 flagged

dist/models/CreateAidbclusterRequest.jsView file

Lines 61-101javascript

61 static names() {

62 return {

63 ackAdmin: 'AckAdmin',

64 autoRenew: 'AutoRenew',

65 autoUseCoupon: 'AutoUseCoupon',

66 clientToken: 'ClientToken',

67 DBClusterDescription: 'DBClusterDescription',

68 DBClusterId: 'DBClusterId',

69 DBNodeClass: 'DBNodeClass',

70 extension: 'Extension',

71 inferenceEngine: 'InferenceEngine',

72 kubeClusterId: 'KubeClusterId',

73 kubeConfig: 'KubeConfig',

74 kubeManagement: 'KubeManagement',

75 kubeType: 'KubeType',

76 kubernetesConfig: 'KubernetesConfig',

77 managementMode: 'ManagementMode',

78 modelName: 'ModelName',

79 ownerAccount: 'OwnerAccount',

80 ownerId: 'OwnerId',

81 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateAidbclusterRequest.jsView on unpkg · L81

82 payType: 'PayType',

83 period: 'Period',

84 promotionCode: 'PromotionCode',

85 regionId: 'RegionId',

86 resourceOwnerAccount: 'ResourceOwnerAccount',

87 resourceOwnerId: 'ResourceOwnerId',

88 securityGroupId: 'SecurityGroupId',

89 storageSpace: 'StorageSpace',

90 storageType: 'StorageType',

91 timeSlices: 'TimeSlices',

92 usedTime: 'UsedTime',

93 VPCId: 'VPCId',

94 vSwitchId: 'VSwitchId',

95 zoneId: 'ZoneId',

96 };

97 }

98 static types() {

99 return {

100 ackAdmin: 'string',

101 autoRenew: 'string',

dist/models/OpenAitaskRequest.jsView file

Lines 26-66javascript

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k =

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView file

Lines 28-68javascript

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length

src/models/OpenAitaskRequest.tsView file

Lines 52-92typescript

52 * @example

53 * rg-************

54 */

55 resourceGroupId?: string;

56 resourceOwnerAccount?: string;

57 resourceOwnerId?: number;

58 /**

59 * @remarks

src/models/CreateAidbclusterRequest.tsView file

Lines 307-347typescript

307 static names(): { [key: string]: string } {

308 return {

309 ackAdmin: 'AckAdmin',

310 autoRenew: 'AutoRenew',

311 autoUseCoupon: 'AutoUseCoupon',

312 clientToken: 'ClientToken',

313 DBClusterDescription: 'DBClusterDescription',

314 DBClusterId:

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView file

Lines 34-74typescript

34 */

35 endpointType?: string;

36 /**

37 * @example

38 * ******

39 */

40 password?: string;

41 /**

42 * @example

43 * 5432

Source & flagged code

6 flagged · loading source

dist/models/CreateAidbclusterRequest.jsView file

81patternName = generic_password severity = medium line = 81 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateAidbclusterRequest.jsView on unpkg · L81

dist/models/OpenAitaskRequest.jsView file

46patternName = generic_password severity = medium line = 46 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/models/OpenAitaskRequest.js

dist/models/OpenAitaskRequest.jsView on unpkg · L46

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView file

48patternName = generic_password severity = medium line = 48 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/models/DescribeAgenticDbbranchEndpointsResponseBody.js

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView on unpkg · L48

src/models/OpenAitaskRequest.tsView file

72patternName = generic_password severity = medium line = 72 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/OpenAitaskRequest.ts

src/models/OpenAitaskRequest.tsView on unpkg · L72

src/models/CreateAidbclusterRequest.tsView file

327patternName = generic_password severity = medium line = 327 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/CreateAidbclusterRequest.ts

src/models/CreateAidbclusterRequest.tsView on unpkg · L327

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView file

54patternName = generic_password severity = medium line = 54 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/DescribeAgenticDbbranchEndpointsResponseBody.ts

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView on unpkg · L54

Findings

6 Medium3 Low

MediumSecret Patterndist/models/CreateAidbclusterRequest.js

MediumSecret Patterndist/models/OpenAitaskRequest.js

MediumSecret Patterndist/models/DescribeAgenticDbbranchEndpointsResponseBody.js

MediumSecret Patternsrc/models/OpenAitaskRequest.ts

MediumSecret Patternsrc/models/CreateAidbclusterRequest.ts

MediumSecret Patternsrc/models/DescribeAgenticDbbranchEndpointsResponseBody.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

6 flagged

dist/models/CreateAidbclusterRequest.jsView file

Lines 61-101javascript

61 static names() {

62 return {

63 ackAdmin: 'AckAdmin',

64 autoRenew: 'AutoRenew',

65 autoUseCoupon: 'AutoUseCoupon',

66 clientToken: 'ClientToken',

67 DBClusterDescription: 'DBClusterDescription',

68 DBClusterId: 'DBClusterId',

69 DBNodeClass: 'DBNodeClass',

70 extension: 'Extension',

71 inferenceEngine: 'InferenceEngine',

72 kubeClusterId: 'KubeClusterId',

73 kubeConfig: 'KubeConfig',

74 kubeManagement: 'KubeManagement',

75 kubeType: 'KubeType',

76 kubernetesConfig: 'KubernetesConfig',

77 managementMode: 'ManagementMode',

78 modelName: 'ModelName',

79 ownerAccount: 'OwnerAccount',

80 ownerId: 'OwnerId',

81 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateAidbclusterRequest.jsView on unpkg · L81

82 payType: 'PayType',

83 period: 'Period',

84 promotionCode: 'PromotionCode',

85 regionId: 'RegionId',

86 resourceOwnerAccount: 'ResourceOwnerAccount',

87 resourceOwnerId: 'ResourceOwnerId',

88 securityGroupId: 'SecurityGroupId',

89 storageSpace: 'StorageSpace',

90 storageType: 'StorageType',

91 timeSlices: 'TimeSlices',

92 usedTime: 'UsedTime',

93 VPCId: 'VPCId',

94 vSwitchId: 'VSwitchId',

95 zoneId: 'ZoneId',

96 };

97 }

98 static types() {

99 return {

100 ackAdmin: 'string',

101 autoRenew: 'string',

dist/models/OpenAitaskRequest.jsView file

Lines 26-66javascript

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k =

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView file

Lines 28-68javascript

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length

src/models/OpenAitaskRequest.tsView file

Lines 52-92typescript

52 * @example

53 * rg-************

54 */

55 resourceGroupId?: string;

56 resourceOwnerAccount?: string;

57 resourceOwnerId?: number;

58 /**

59 * @remarks

src/models/CreateAidbclusterRequest.tsView file

Lines 307-347typescript

307 static names(): { [key: string]: string } {

308 return {

309 ackAdmin: 'AckAdmin',

310 autoRenew: 'AutoRenew',

311 autoUseCoupon: 'AutoUseCoupon',

312 clientToken: 'ClientToken',

313 DBClusterDescription: 'DBClusterDescription',

314 DBClusterId:

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView file

Lines 34-74typescript

34 */

35 endpointType?: string;

36 /**

37 * @example

38 * ******

39 */

40 password?: string;

41 /**

42 * @example

43 * 5432