registry / @hiai-gg/hiai-admin / 0.0.6

@hiai-gg/hiai-admin@0.0.6

Central admin panel for the HiAi SaaS platform — tenant management, billing, analytics, and platform settings

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 160 file(s), 401 KB of source, external domains: api.goshippo.com, api.novu.co, api.stripe.com, hooks.stripe.com, js.stripe.com, ko-fi.com, maps.stripe.com, opensource.org

Source & flagged code

3 flagged

backend/src/db/auto-push.tsView file

Lines 1-49typescript

1#!/usr/bin/env bun

2/**

3 * DB_AUTO_PUSH gate.

4 *

5 * `drizzle-kit push` is DESTRUCTIVE — it drops columns whose definitions

6 * were removed, rewrites types, and may drop data. It must NEVER run

7 * implicitly. This script enforces explicit opt-in: the operator sets

8 * DB_AUTO_PUSH=true in the environment to allow the push.

9 *

10 * Typical usage from a CI / migration job:

11 *

12 * DB_AUTO_PUSH=true bun run db:auto-push # actually pushes

13 * bun run db:auto-push # fails fast with a clear message

14 *

15 * For production, prefer `bun run db:generate` + `bun run db:migrate`

16 * (creates a checked-in SQL migration that operators review before applying).

17 * `db:auto-push` is for development environments only.

18 */

19import { execSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

backend/src/db/auto-push.tsView on unpkg · L18

21const enabled = process.env.DB_AUTO_PUSH === 'true' || process.env.DB_AUTO_PUSH === '1';

23if (!enabled) {

24 console.error('');

25 console.error('[db:auto-push] ABORTED: DB_AUTO_PUSH is not set.');

26 console.error('');

27 console.error(' `drizzle-kit push` is destructive (drops columns, rewrites types).');

28 console.error(' For production use committed migrations instead:');

29 console.error('');

30 console.error(' bun run db:generate # produces a SQL migration in backend/drizzle/');

31 console.error(' bun run db:migrate # applies pending migrations');

32 console.error('');

33 console.error(' If you really want to push the current schema, run:');

34 console.error('');

35 console.error(' DB_AUTO_PUSH=true bun run db:auto-push');

36 console.error('');

37 process.exit(1);

38}

40console.log('[db:auto-push] DB_AUTO_PUSH=true — running `drizzle-kit push --force` …');

41try {

42 execSync('bunx drizzle-kit push --force', { stdio: 'inherit' });

43} catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backend/src/db/auto-push.tsView on unpkg · L41

44 console.error('[db:auto-push] drizzle-kit push failed:', err);

45 process.exit(1);

46}

48console.log('[db:auto-push] schema pushed.');

backend/test-migration.shView file

•path = backend/test-migration.sh kind = build_helper sizeBytes = 650 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

backend/test-migration.shView on unpkg

Source & flagged code

3 flagged · loading source

backend/src/db/auto-push.tsView file

18*/ L19: import { execSync } from 'node:child_process'; L20:

High

Child Process

Package source references child process execution.

backend/src/db/auto-push.tsView on unpkg · L18

41try { L42: execSync('bunx drizzle-kit push --force', { stdio: 'inherit' }); L43: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backend/src/db/auto-push.tsView on unpkg · L41

backend/test-migration.shView file

•path = backend/test-migration.sh kind = build_helper sizeBytes = 650 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

backend/test-migration.shView on unpkg

Findings

3 High4 Medium4 Low

HighChild Processbackend/src/db/auto-push.ts

HighShell

HighRuntime Package Installbackend/src/db/auto-push.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbackend/test-migration.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

backend/src/db/auto-push.tsView file

Lines 1-49typescript

1#!/usr/bin/env bun

2/**

3 * DB_AUTO_PUSH gate.

4 *

5 * `drizzle-kit push` is DESTRUCTIVE — it drops columns whose definitions

6 * were removed, rewrites types, and may drop data. It must NEVER run

7 * implicitly. This script enforces explicit opt-in: the operator sets

8 * DB_AUTO_PUSH=true in the environment to allow the push.

9 *

10 * Typical usage from a CI / migration job:

11 *

12 * DB_AUTO_PUSH=true bun run db:auto-push # actually pushes

13 * bun run db:auto-push # fails fast with a clear message

14 *

15 * For production, prefer `bun run db:generate` + `bun run db:migrate`

16 * (creates a checked-in SQL migration that operators review before applying).

17 * `db:auto-push` is for development environments only.

18 */

19import { execSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

backend/src/db/auto-push.tsView on unpkg · L18

21const enabled = process.env.DB_AUTO_PUSH === 'true' || process.env.DB_AUTO_PUSH === '1';

23if (!enabled) {

24 console.error('');

25 console.error('[db:auto-push] ABORTED: DB_AUTO_PUSH is not set.');

26 console.error('');

27 console.error(' `drizzle-kit push` is destructive (drops columns, rewrites types).');

28 console.error(' For production use committed migrations instead:');

29 console.error('');

30 console.error(' bun run db:generate # produces a SQL migration in backend/drizzle/');

31 console.error(' bun run db:migrate # applies pending migrations');

32 console.error('');

33 console.error(' If you really want to push the current schema, run:');

34 console.error('');

35 console.error(' DB_AUTO_PUSH=true bun run db:auto-push');

36 console.error('');

37 process.exit(1);

38}

40console.log('[db:auto-push] DB_AUTO_PUSH=true — running `drizzle-kit push --force` …');

41try {

42 execSync('bunx drizzle-kit push --force', { stdio: 'inherit' });

43} catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backend/src/db/auto-push.tsView on unpkg · L41

44 console.error('[db:auto-push] drizzle-kit push failed:', err);

45 process.exit(1);

46}

48console.log('[db:auto-push] schema pushed.');

backend/test-migration.shView file

•path = backend/test-migration.sh kind = build_helper sizeBytes = 650 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

backend/test-migration.shView on unpkg