registry / @alicloud/polardb20170801 / 7.6.0

@alicloud/polardb20170801@7.6.0

English | [简体中文](README-CN.md) ![](https://aliyunsdk-pages.alicdn.com/icons/AlibabaCloud.svg)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a generated PolarDB SDK that sends explicitly requested API calls to configured Alibaba Cloud endpoints.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer imports the SDK, constructs a client, and explicitly invokes a PolarDB API method.

Impact

Can manage PolarDB resources only through caller-provided configuration, credentials, and request data.

Mechanism

Generated OpenAPI request construction and delegated HTTPS API calls.

Rationale

The scanner's possible-secret finding is a generated request-model field for a user-provided API password, not an embedded secret or exfiltration path. Source inspection found no install-time execution, local harvesting, persistence, remote payload loading, or unconsented control-surface mutation.

Evidence

package.jsonsrc/client.tsdist/client.jssrc/models/CreateAidbclusterRequest.tsdist/models/CreateAidbclusterRequest.jsREADME.md

Network endpoints3

polardb.aliyuncs.compolardb.us-west-1.aliyuncs.compolardb.us-east-1.aliyuncs.com

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

`src/client.ts` exposes caller-invoked PolarDB management operations over HTTPS.
`CreateAidbclusterRequest` accepts user-supplied password and Kubernetes configuration fields for an API request.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` hook; `prepublishOnly` only runs `tsc`.
`dist/client.js` imports only `@darabonba/typescript`, `@alicloud/openapi-core`, and local models.
No `child_process`, `eval`, `Function`, `vm`, environment access, or filesystem read/write primitives were found in source or dist files.
`src/client.ts` maps regional endpoints to Alibaba Cloud PolarDB hosts and constructs authenticated RPC requests only after explicit client method calls.
`src/models/CreateAidbclusterRequest.ts` documents `password` as an API parameter; no credential value is embedded or harvested.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2,598 file(s), 8.68 MB of source

Source & flagged code

6 flagged

dist/models/CreateAidbclusterRequest.jsView file

Lines 61-101javascript

61 static names() {

62 return {

63 ackAdmin: 'AckAdmin',

64 autoRenew: 'AutoRenew',

65 autoUseCoupon: 'AutoUseCoupon',

66 clientToken: 'ClientToken',

67 DBClusterDescription: 'DBClusterDescription',

68 DBClusterId: 'DBClusterId',

69 DBNodeClass: 'DBNodeClass',

70 extension: 'Extension',

71 inferenceEngine: 'InferenceEngine',

72 kubeClusterId: 'KubeClusterId',

73 kubeConfig: 'KubeConfig',

74 kubeManagement: 'KubeManagement',

75 kubeType: 'KubeType',

76 kubernetesConfig: 'KubernetesConfig',

77 managementMode: 'ManagementMode',

78 modelName: 'ModelName',

79 ownerAccount: 'OwnerAccount',

80 ownerId: 'OwnerId',

81 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateAidbclusterRequest.jsView on unpkg · L81

82 payType: 'PayType',

83 period: 'Period',

84 promotionCode: 'PromotionCode',

85 regionId: 'RegionId',

86 resourceOwnerAccount: 'ResourceOwnerAccount',

87 resourceOwnerId: 'ResourceOwnerId',

88 securityGroupId: 'SecurityGroupId',

89 storageSpace: 'StorageSpace',

90 storageType: 'StorageType',

91 timeSlices: 'TimeSlices',

92 usedTime: 'UsedTime',

93 VPCId: 'VPCId',

94 vSwitchId: 'VSwitchId',

95 zoneId: 'ZoneId',

96 };

97 }

98 static types() {

99 return {

100 ackAdmin: 'string',

101 autoRenew: 'string',

dist/models/OpenAitaskRequest.jsView file

Lines 26-66javascript

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k =

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView file

Lines 28-68javascript

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length

src/models/OpenAitaskRequest.tsView file

Lines 52-92typescript

52 * @example

53 * rg-************

54 */

55 resourceGroupId?: string;

56 resourceOwnerAccount?: string;

57 resourceOwnerId?: number;

58 /**

59 * @remarks

src/models/CreateAidbclusterRequest.tsView file

Lines 307-347typescript

307 static names(): { [key: string]: string } {

308 return {

309 ackAdmin: 'AckAdmin',

310 autoRenew: 'AutoRenew',

311 autoUseCoupon: 'AutoUseCoupon',

312 clientToken: 'ClientToken',

313 DBClusterDescription: 'DBClusterDescription',

314 DBClusterId:

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView file

Lines 34-74typescript

34 */

35 endpointType?: string;

36 /**

37 * @example

38 * ******

39 */

40 password?: string;

41 /**

42 * @example

43 * 5432

Source & flagged code

6 flagged · loading source

dist/models/CreateAidbclusterRequest.jsView file

81patternName = generic_password severity = medium line = 81 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateAidbclusterRequest.jsView on unpkg · L81

dist/models/OpenAitaskRequest.jsView file

46patternName = generic_password severity = medium line = 46 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/models/OpenAitaskRequest.js

dist/models/OpenAitaskRequest.jsView on unpkg · L46

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView file

48patternName = generic_password severity = medium line = 48 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/models/DescribeAgenticDbbranchEndpointsResponseBody.js

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView on unpkg · L48

src/models/OpenAitaskRequest.tsView file

72patternName = generic_password severity = medium line = 72 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/OpenAitaskRequest.ts

src/models/OpenAitaskRequest.tsView on unpkg · L72

src/models/CreateAidbclusterRequest.tsView file

327patternName = generic_password severity = medium line = 327 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/CreateAidbclusterRequest.ts

src/models/CreateAidbclusterRequest.tsView on unpkg · L327

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView file

54patternName = generic_password severity = medium line = 54 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/DescribeAgenticDbbranchEndpointsResponseBody.ts

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView on unpkg · L54

Findings

6 Medium3 Low

MediumSecret Patterndist/models/CreateAidbclusterRequest.js

MediumSecret Patterndist/models/OpenAitaskRequest.js

MediumSecret Patterndist/models/DescribeAgenticDbbranchEndpointsResponseBody.js

MediumSecret Patternsrc/models/OpenAitaskRequest.ts

MediumSecret Patternsrc/models/CreateAidbclusterRequest.ts

MediumSecret Patternsrc/models/DescribeAgenticDbbranchEndpointsResponseBody.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

6 flagged

dist/models/CreateAidbclusterRequest.jsView file

Lines 61-101javascript

61 static names() {

62 return {

63 ackAdmin: 'AckAdmin',

64 autoRenew: 'AutoRenew',

65 autoUseCoupon: 'AutoUseCoupon',

66 clientToken: 'ClientToken',

67 DBClusterDescription: 'DBClusterDescription',

68 DBClusterId: 'DBClusterId',

69 DBNodeClass: 'DBNodeClass',

70 extension: 'Extension',

71 inferenceEngine: 'InferenceEngine',

72 kubeClusterId: 'KubeClusterId',

73 kubeConfig: 'KubeConfig',

74 kubeManagement: 'KubeManagement',

75 kubeType: 'KubeType',

76 kubernetesConfig: 'KubernetesConfig',

77 managementMode: 'ManagementMode',

78 modelName: 'ModelName',

79 ownerAccount: 'OwnerAccount',

80 ownerId: 'OwnerId',

81 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateAidbclusterRequest.jsView on unpkg · L81

82 payType: 'PayType',

83 period: 'Period',

84 promotionCode: 'PromotionCode',

85 regionId: 'RegionId',

86 resourceOwnerAccount: 'ResourceOwnerAccount',

87 resourceOwnerId: 'ResourceOwnerId',

88 securityGroupId: 'SecurityGroupId',

89 storageSpace: 'StorageSpace',

90 storageType: 'StorageType',

91 timeSlices: 'TimeSlices',

92 usedTime: 'UsedTime',

93 VPCId: 'VPCId',

94 vSwitchId: 'VSwitchId',

95 zoneId: 'ZoneId',

96 };

97 }

98 static types() {

99 return {

100 ackAdmin: 'string',

101 autoRenew: 'string',

dist/models/OpenAitaskRequest.jsView file

Lines 26-66javascript

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k =

dist/models/DescribeAgenticDbbranchEndpointsResponseBody.jsView file

Lines 28-68javascript

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length

src/models/OpenAitaskRequest.tsView file

Lines 52-92typescript

52 * @example

53 * rg-************

54 */

55 resourceGroupId?: string;

56 resourceOwnerAccount?: string;

57 resourceOwnerId?: number;

58 /**

59 * @remarks

src/models/CreateAidbclusterRequest.tsView file

Lines 307-347typescript

307 static names(): { [key: string]: string } {

308 return {

309 ackAdmin: 'AckAdmin',

310 autoRenew: 'AutoRenew',

311 autoUseCoupon: 'AutoUseCoupon',

312 clientToken: 'ClientToken',

313 DBClusterDescription: 'DBClusterDescription',

314 DBClusterId:

src/models/DescribeAgenticDbbranchEndpointsResponseBody.tsView file

Lines 34-74typescript

34 */

35 endpointType?: string;

36 /**

37 * @example

38 * ******

39 */

40 password?: string;

41 /**

42 * @example

43 * 5432