registry / @elkindev/dbgraph / 1.1.0

@elkindev/dbgraph@1.1.0

Database schema graph for AI agents — index your database catalog into a local graph, served over MCP

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 4.46 MB of source, external domains: 169.254.169.254, d3js.org, github.com, jira.mongodb.org, learn.microsoft.com, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, sidorares.github.io, tools.ietf.org, vault.azure.net, www.mongodb.com, www.npmjs.com, www.postgresql.org

Oversized source lightweight scan

dist/index.cjs5.58 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringslearn.microsoft.comlogin.chinacloudapi.cnlogin.microsoftonline.comlogin.microsoftonline.delogin.microsoftonline.uswww.npmjs.com

dist/tedious-3WZBQM6C.js2.28 MB file, sampled 256 KB

ChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsgithub.comlogin.chinacloudapi.cnlogin.microsoftonline.comlogin.microsoftonline.delogin.microsoftonline.us

Source & flagged code

7 flagged

dist/chunk-WTMFADWS.jsView file

Lines 59-99javascript

59 }

60 return resolved2;

61 }

62 const resolved = {

63 server: resolveValue(source.server, envMap),

64 database: resolveValue(source.database, envMap),

65 // Guard each credential field — only resolve when present (A1.6).

66 user: source.user !== void 0 ? resolveValue(source.user, envMap) : missingCredential("user"),

67 password: source.password !== void 0 ? resolveValue(source.password, envMap) : missingCredential("password")

68 };

69 if (source.port !== void 0) {

70 resolved.port = resolveValue(source.port, envMap);

71 }

72 if (source.domain !== void 0) {

73 resolved.domain = resolveValue(source.domain, envMap);

74 }

75 if (source.auth !== void 0) {

76 resolved.auth = source.auth;

77 }

78 return resolved;

79}

80function resolveSecrets(cfg, envMap = process.env) {

81 switch (cfg.dialect) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-WTMFADWS.jsView on unpkg · L79

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-WTMFADWS.jsView on unpkg · L79

82 case "sqlite": {

83 const resolvedSource = resolveSqliteSource(cfg.source, envMap);

84 const result = cfg.levels !== void 0 ? cfg.driver !== void 0 ? { dialect: "sqlite", source: resolvedSource, levels: cfg.levels, driver: cfg.driver } : { dialect: "sqlite", source: resolvedSource, levels: cfg.levels } : cfg.driver !== void 0 ? { dialect: "sqlite", source: resolvedSource, driver: cfg.driver } : { dialect: "sqlite", source: resolvedSource };

85 return result;

86 }

87 case "mssql": {

88 const resolvedSource = resolveMssqlSource(cfg.source, envMap);

89 const result = cfg.levels !== void 0 ? { dialect: "mssql", source: resolvedSource, levels: cfg.levels } : { dialect: "mssql", source: resolvedSource };

90 return result;

91 }

92 case "pg": {

93 const resolvedSource = resolvePgSource(cfg.source, envMap);

94 const result = cfg.levels !== void 0 ? { dialect: "pg", source: resolvedSource, levels: cfg.levels } : { dialect: "pg", source: resolvedSource };

95 return result;

96 }

97 case "mysql": {

98 const resolvedSource = resolveMysqlSource(cfg.source, envMap);

99 const result = cfg.levels !== void 0 ? { dialect: "mysql", source: resolvedSource, levels: cfg.levels } : { dialect: "mysql", source: resolvedSource };

Lines 132-172javascript

132function resolveMongodbSource(source, envMap) {

133 const resolved = {

134 uri: resolveValue(source.uri, envMap),

135 database: source.database

136 };

137 if (source.sampleSize !== void 0) resolved.sampleSize = source.sampleSize;

138

Lines 2903-2943javascript

2903 };

2904}

2905

2906// src/adapters/storage/sqlite/handle.ts

2907function betterSqliteHandle(db) {

2908 return {

2909 prepare(sql) {

2910 const stmt = db.prepare(sql);

2911 return

dist/open-WLBPYZLW.jsView file

Lines 75-115javascript

75 }

76 return true;

77 }

78 try {

79 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

80 return !isInsideContainer

dist/lib-HSEC5IHY.jsView file

83array: 4, L84: binData: 5, L85: undefined: 6, ... L141: }; L142: var TextDecoderFatal; L143: var TextDecoderNonFatal; ... L321: const { console: console2 } = globalThis; L322: console2?.warn?.("BSON: For React Native please polyfill crypto.getRandomValues, e.g. using: https://www.npmjs.com/package/react-native-get-random-values."); L323: } ... L10201: function resolveLogPath({ MONGODB_LOG_PATH }, { mongodbLogPath }) { L10202: if (typeof mongodbLogPath === "string" && /^stderr$/i.test(mongodbLogPath)) { L10203: return { mongodbLogPath: createStdioLogger(process.stderr), mongodbLogPathIsStdErr: true };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/lib-HSEC5IHY.jsView on unpkg · L83

dist/tedious-3WZBQM6C.jsView file

•path = dist/tedious-3WZBQM6C.js kind = oversized_source_file sizeBytes = 2395661 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/tedious-3WZBQM6C.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/chunk-WTMFADWS.jsView file

2923}, L2924: exec(sql) { L2925: db.exec(sql);

High

Child Process

Package source references child process execution.

dist/chunk-WTMFADWS.jsView on unpkg · L2923

79Cross-file remote execution chain: dist/chunk-WTMFADWS.js spawns dist/mysql2-JRR5EBJC.js; helper contains network access plus dynamic code execution. L79: } L80: function resolveSecrets(cfg, envMap = process.env) { L81: switch (cfg.dialect) { ... L161: const configPath = join(projectRoot, "dbgraph.config.json"); L162: const rawJson = JSON.parse(readFileSync(configPath, "utf-8")); L163: const cfg = parseConfig(rawJson); ... L328: bodyHash: null, L329: ftsBody: "", L330: ...comment !== void 0 ? { comment } : {} ... L2923: }, L2924: exec(sql) { L2925: db.exec(sql);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-WTMFADWS.jsView on unpkg · L79

152try { L153: const sea = createRequire(process.execPath)("node:sea"); L154: return typeof sea.isSea === "function" ? sea.isSea() : false;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-WTMFADWS.jsView on unpkg · L152

79} L80: function resolveSecrets(cfg, envMap = process.env) { L81: switch (cfg.dialect) { ... L161: const configPath = join(projectRoot, "dbgraph.config.json"); L162: const rawJson = JSON.parse(readFileSync(configPath, "utf-8")); L163: const cfg = parseConfig(rawJson); ... L328: bodyHash: null, L329: ftsBody: "", L330: ...comment !== void 0 ? { comment } : {} ... L2923: }, L2924: exec(sql) { L2925: db.exec(sql);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-WTMFADWS.jsView on unpkg · L79

dist/open-WLBPYZLW.jsView file

95import fs4, { constants as fsConstants } from "fs/promises"; L96: var wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath; L97: var init_wsl_utils = __esm({

High

Shell

Package source references shell execution.

dist/open-WLBPYZLW.jsView on unpkg · L95

dist/lib-HSEC5IHY.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/lib-HSEC5IHY.jsView on unpkg · L83

dist/tedious-3WZBQM6C.jsView file

•path = dist/tedious-3WZBQM6C.js kind = oversized_source_file sizeBytes = 2395661 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/tedious-3WZBQM6C.jsView on unpkg

Findings

5 High4 Medium7 Low

HighChild Processdist/chunk-WTMFADWS.js

HighShelldist/open-WLBPYZLW.js

HighCloud Metadata Accessdist/lib-HSEC5IHY.js

HighCross File Remote Execution Contextdist/chunk-WTMFADWS.js

HighOversized Source Filedist/tedious-3WZBQM6C.js

MediumDynamic Requiredist/chunk-WTMFADWS.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/chunk-WTMFADWS.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/chunk-WTMFADWS.jsView file

Lines 59-99javascript

59 }

60 return resolved2;

61 }

62 const resolved = {

63 server: resolveValue(source.server, envMap),

64 database: resolveValue(source.database, envMap),

65 // Guard each credential field — only resolve when present (A1.6).

66 user: source.user !== void 0 ? resolveValue(source.user, envMap) : missingCredential("user"),

67 password: source.password !== void 0 ? resolveValue(source.password, envMap) : missingCredential("password")

68 };

69 if (source.port !== void 0) {

70 resolved.port = resolveValue(source.port, envMap);

71 }

72 if (source.domain !== void 0) {

73 resolved.domain = resolveValue(source.domain, envMap);

74 }

75 if (source.auth !== void 0) {

76 resolved.auth = source.auth;

77 }

78 return resolved;

79}

80function resolveSecrets(cfg, envMap = process.env) {

81 switch (cfg.dialect) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-WTMFADWS.jsView on unpkg · L79

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-WTMFADWS.jsView on unpkg · L79

82 case "sqlite": {

83 const resolvedSource = resolveSqliteSource(cfg.source, envMap);

85 return result;

86 }

87 case "mssql": {

88 const resolvedSource = resolveMssqlSource(cfg.source, envMap);

89 const result = cfg.levels !== void 0 ? { dialect: "mssql", source: resolvedSource, levels: cfg.levels } : { dialect: "mssql", source: resolvedSource };

90 return result;

91 }

92 case "pg": {

93 const resolvedSource = resolvePgSource(cfg.source, envMap);

94 const result = cfg.levels !== void 0 ? { dialect: "pg", source: resolvedSource, levels: cfg.levels } : { dialect: "pg", source: resolvedSource };

95 return result;

96 }

97 case "mysql": {

98 const resolvedSource = resolveMysqlSource(cfg.source, envMap);

99 const result = cfg.levels !== void 0 ? { dialect: "mysql", source: resolvedSource, levels: cfg.levels } : { dialect: "mysql", source: resolvedSource };

Lines 132-172javascript

132function resolveMongodbSource(source, envMap) {

133 const resolved = {

134 uri: resolveValue(source.uri, envMap),

135 database: source.database

136 };

137 if (source.sampleSize !== void 0) resolved.sampleSize = source.sampleSize;

138

Lines 2903-2943javascript

2903 };

2904}

2905

2906// src/adapters/storage/sqlite/handle.ts

2907function betterSqliteHandle(db) {

2908 return {

2909 prepare(sql) {

2910 const stmt = db.prepare(sql);

2911 return

dist/open-WLBPYZLW.jsView file

Lines 75-115javascript

75 }

76 return true;

77 }

78 try {

79 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

80 return !isInsideContainer

dist/lib-HSEC5IHY.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/lib-HSEC5IHY.jsView on unpkg · L83

dist/tedious-3WZBQM6C.jsView file

•path = dist/tedious-3WZBQM6C.js kind = oversized_source_file sizeBytes = 2395661 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/tedious-3WZBQM6C.jsView on unpkg