registry / @ingram-tech/nk-db / 1.3.0

@ingram-tech/nk-db@1.3.0

The Ingram Postgres data layer: one TLS-aware pg pool, raw-SQL helpers, Drizzle wiring, and a PGlite (no-Docker) dev/test harness for Next.js sites.

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 46.1 KB of source

Source & flagged code

2 flagged

dist/pglite/index.jsView file

Lines 52-98javascript

52 ? await PGlite.create({ dataDir, extensions: options.extensions })

53 : await PGlite.create({ extensions: options.extensions });

54 // Always run migrations: the drizzle migrator is journal-tracked, so on an

55 // existing dataDir this applies only what's new (previously it was skipped

56 // entirely whenever the dir existed, silently ignoring added migrations

57 // until a --fresh wipe). A custom `migrate` must be idempotent the same way.

58 await (options.migrate ?? defaultMigrate(migrationsFolder))(db);

59 const server = new PGLiteSocketServer({ db, host, port });

60 await server.start();

61 const databaseUrl = `postgresql://postgres:postgres@${host}:${port}/postgres`;

62 const stop = async () => {

63 await server.stop().catch(() => { });

64 await db.close().catch(() => { });

65 };

66 return { db, server, databaseUrl, stop };

67};

68/**

69 * `nk dev`'s PGlite mode: boot a persisted local Postgres, then `next dev` with

70 * `DATABASE_URL` pointed at it. Invoked by the `nk-pglite-dev` bin.

71 */

72export const startPgliteDev = async (options = {}) => {

73 const { spawn } = await import("node:child_process");

74 const { databaseUrl, stop } = await createPgliteServer({

High

Child Process

Package source references child process execution.

dist/pglite/index.jsView on unpkg · L72

75 dataDir: options.dataDir ?? ".pglite",

76 ...options,

77 });

78 console.log(`nk(pglite): Postgres 18 (WASM) ready on ${databaseUrl} — no Docker, no external service`);

79 const child = spawn("bunx", ["next", "dev", "--turbopack", ...(options.nextArgs ?? [])], { stdio: "inherit", env: { ...process.env, DATABASE_URL: databaseUrl } });

80 let closing = false;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/pglite/index.jsView on unpkg · L78

81 const close = async (code) => {

82 if (closing)

83 return;

84 closing = true;

85 await stop();

86 process.exit(code);

87 };

88 process.on("SIGINT", () => child.kill("SIGINT"));

89 process.on("SIGTERM", () => child.kill("SIGTERM"));

90 child.on("exit", (code) => void close(code ?? 0));

91 // Without this, a failed spawn (e.g. bunx missing) is an uncaught exception

92 // and the socket server never shuts down.

93 child.on("error", (err) => {

94 console.error(`nk(pglite): failed to start next dev: ${err.message}`);

95 void close(1);

96 });

97};

98/**

Source & flagged code

2 flagged · loading source

dist/pglite/index.jsView file

72export const startPgliteDev = async (options = {}) => { L73: const { spawn } = await import("node:child_process"); L74: const { databaseUrl, stop } = await createPgliteServer({

High

Child Process

Package source references child process execution.

dist/pglite/index.jsView on unpkg · L72

78console.log(`nk(pglite): Postgres 18 (WASM) ready on ${databaseUrl} — no Docker, no external service`); L79: const child = spawn("bunx", ["next", "dev", "--turbopack", ...(options.nextArgs ?? [])], { stdio: "inherit", env: { ...process.env, DATABASE_URL: databaseUrl } }); L80: let closing = false;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/pglite/index.jsView on unpkg · L78

Findings

2 High2 Medium3 Low

HighChild Processdist/pglite/index.js

HighRuntime Package Installdist/pglite/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings