@hypequery/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 155 KB of source, external domains: hypequery.com

Source & flagged code

3 flagged

dist/commands/init.jsView file

Lines 302-342javascript

302 const envExists = await hasEnvFile();

303 if (envExists) {

304 const existingEnv = await readFile(envPath, 'utf-8');

305 const newEnv = appendToEnv(existingEnv, generateEnvTemplate(connectionConfig));

306 await writeFile(envPath, newEnv);

307 logger.success('Updated .env');

308 }

309 else {

310 await writeFile(envPath, generateEnvTemplate(connectionConfig));

311 logger.success('Created .env');

312 }

313 }

314 else {

315 // Create placeholder .env

316 const envPath = path.join(process.cwd(), '.env');

317 const envExists = await hasEnvFile();

318 const placeholderConfig = {

319 url: 'YOUR_CLICKHOUSE_URL',

320 database: 'YOUR_DATABASE',

321 username: 'YOUR_USERNAME',

322 password: 'YOUR_PASSWORD',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L322

323 };

324 if (!envExists) {

325 await writeFile(envPath, generateEnvTemplate(placeholderConfig));

326 logger.success('Created .env (configure your credentials)');

327 }

328 }

329 // Step 9: Generate types from schema (only if we have a valid connection)

330 const schemaPath = path.join(resolvedOutputDir, 'schema.ts');

331 if (hasValidConnection) {

332 const typeSpinner = ora('Generating TypeScript types...').start();

333 try {

334 const generator = getTypeGenerator(database);

335 await generator({ outputPath: schemaPath, chdbPath });

336 typeSpinner.succeed(`Generated TypeScript types (${path.relative(process.cwd(), schemaPath)})`);

337 }

338 catch (error) {

339 typeSpinner.fail('Failed to generate types');

340 logger.error(error instanceof Error ? error.message : String(error));

341 process.exit(1);

342 }

dist/utils/load-api.jsView file

Lines 59-99javascript

59 }

60 return api;

61}

62export async function loadModule(modulePath) {

63 const resolved = path.resolve

dist/commands/dev.jsView file

Lines 80-120javascript

80 const baseUrl = `http://${hostname}:${port}`;

81 const docsPath = api.docs?.path ?? '/docs';

82 const

Source & flagged code

3 flagged · loading source

dist/commands/init.jsView file

@hypequery/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

dist/commands/init.jsView file

Lines 302-342javascript

302 const envExists = await hasEnvFile();

303 if (envExists) {

304 const existingEnv = await readFile(envPath, 'utf-8');

305 const newEnv = appendToEnv(existingEnv, generateEnvTemplate(connectionConfig));

306 await writeFile(envPath, newEnv);

307 logger.success('Updated .env');

308 }

309 else {

310 await writeFile(envPath, generateEnvTemplate(connectionConfig));

311 logger.success('Created .env');

312 }

313 }

314 else {

315 // Create placeholder .env

316 const envPath = path.join(process.cwd(), '.env');

317 const envExists = await hasEnvFile();

318 const placeholderConfig = {

319 url: 'YOUR_CLICKHOUSE_URL',

320 database: 'YOUR_DATABASE',

321 username: 'YOUR_USERNAME',

322 password: 'YOUR_PASSWORD',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L322

323 };

324 if (!envExists) {

325 await writeFile(envPath, generateEnvTemplate(placeholderConfig));

326 logger.success('Created .env (configure your credentials)');

327 }

328 }

329 // Step 9: Generate types from schema (only if we have a valid connection)

330 const schemaPath = path.join(resolvedOutputDir, 'schema.ts');

331 if (hasValidConnection) {

332 const typeSpinner = ora('Generating TypeScript types...').start();

333 try {

334 const generator = getTypeGenerator(database);

335 await generator({ outputPath: schemaPath, chdbPath });

336 typeSpinner.succeed(`Generated TypeScript types (${path.relative(process.cwd(), schemaPath)})`);

337 }

338 catch (error) {

339 typeSpinner.fail('Failed to generate types');

340 logger.error(error instanceof Error ? error.message : String(error));

341 process.exit(1);

342 }

dist/utils/load-api.jsView file

Lines 59-99javascript

59 }

60 return api;

61}

62export async function loadModule(modulePath) {

63 const resolved = path.resolve

dist/commands/dev.jsView file

Lines 80-120javascript

80 const baseUrl = `http://${hostname}:${port}`;

81 const docsPath = api.docs?.path ?? '/docs';

82 const

@hypequery/cli@1.9.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code