registry / @libredb/studio / 0.9.38

@libredb/studio@0.9.38

No runnable server (bin) in these versions. Use Node 24+ (or an explicit @latest spec) so npx resolves the current release.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface found. Network, environment variable, SSH, and database primitives are aligned with a database studio/LLM assistant package and require runtime user configuration or UI action.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports library components or explicitly creates DB/LLM providers.

Impact

Expected connections to user-selected databases, SSH hosts, local app APIs, or configured LLM endpoints; no hidden credential harvesting or persistence found.

Mechanism

User-configured database, SSH tunnel, and LLM provider operations.

Rationale

Static inspection found a published dist-only React/Next database studio library with user-invoked DB connectors, SSH tunneling, local app fetches, and LLM API clients. The scanner's secret/network/env findings map to documented default/demo credentials or package-aligned configuration paths, with no install-time execution, obfuscated payload, credential exfiltration, or AI-agent control-surface mutation.

Evidence

package.jsondist/index.jsdist/chunk-TBGKLAGA.jsdist/chunk-CVK3CTLF.jsdist/openai-NKS4RCTB.jsdist/custom-ZAYXQ67P.jsdist/chunk-AXBPQRG7.js

Network endpoints7

api.openai.com/v1localhost:11434/v1/api/db/test-connection/api/ai/chat/api/ai/explain/api/ai/nl2sql/api/ai/query-safety

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall hooks; prepublishOnly only runs tsup and package type checks.
dist/index.js only re-exports providers and React components.
dist/chunk-TBGKLAGA.js network/ssh code is user-invoked DB provider creation and SSH tunneling.
dist/openai-NKS4RCTB.js and dist/custom-ZAYXQ67P.js send configured prompts to LLM chat endpoints, not hidden exfiltration.
dist/chunk-CVK3CTLF.js reads expected LLM_* env vars and masks API key in logging.
dist/chunk-AXBPQRG7.js stores connection form secrets in React state for user-submitted DB/SSH config.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 56 file(s), 1.64 MB of source, external domains: api.openai.com, example.com, picsum.photos

Source & flagged code

8 flagged

dist/chunk-AXBPQRG7.jsView file

Lines 1037-1077javascript

1037 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1038 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1039 /* @__PURE__ */ jsxRuntime.jsx(

1040 "textarea",

1041 {

1042 value: clientCert,

1043 onChange: (e) => setClientCert(e.target.value),

1044 placeholder: "-----BEGIN CERTIFICATE-----\nOptional client cert...\n-----END CERTIFICATE-----",

1045 rows: 3,

1046 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1047 }

1048 )

1049 ] }),

1050 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1051 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Private Key (PEM)" }),

1052 /* @__PURE__ */ jsxRuntime.jsx(

1053 "textarea",

1054 {

1055 value: clientKey,

1056 onChange: (e) => setClientKey(e.target.value),

1057 placeholder: "-----BEGIN PRIVATE KEY-----\nOptional client key...\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1058 rows: 3,

1059 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1060 }

1061 )

1062 ] })

1063 ] })

1064 ] })

1065 ] })

1066 }

1067 ) }),

1068 /* @__PURE__ */ jsxRuntime.jsxs(

1069 "button",

1070 {

1071 type: "button",

1072 onClick: () => setShowSSH(!showSSH),

1073 className: "flex items-center gap-2 w-full px-3 py-2 rounded-lg border border-white/5 hover:border-white/10 bg-zinc-900/30 text-xs font-medium text-zinc-400 hover:text-zinc-200 transition-all",

1074 children: [

1075 /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Terminal, { strokeWidth: 1.5, className: "w-3.5 h-3.5 text-purple-500" }),

1076 /* @__PURE__ */ jsxRuntime.jsx("span", { children: "SSH Tunnel" }),

1077 sshEnabled && /* @__PURE__ */ jsxRuntime.jsx("span", { className: "ml-1 px-1.5 py-0.5 rounded text-[0.625rem] bg-purple-500/10 text-purple-400 border border-purple-500/20", children: "ON" }),

Lines 1169-1209javascript

1169 sshAuthMethod === "password" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1170 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1171 /* @__PURE__ */ jsxRuntime.jsx(

1172 chunkEGAZAL6X_js.Input,

1173 {

1174

dist/chunk-AXFO3IQH.mjsView file

Lines 1016-1056javascript

1016 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1017 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1018 /* @__PURE__ */ jsx(

1019 "textarea",

1020 {

README.mdView file

Lines 516-567markdown

516- Hot-reload: config changes apply within 60s without restart

517- Works with Docker, docker-compose, and Kubernetes (Helm)

518

519**1. Create a config file** (`seed-connections.yaml`):

520

521```yaml

522version: "1"

523

524defaults:

525 managed: true

Source & flagged code

8 flagged · loading source

dist/chunk-AXBPQRG7.jsView file

1057patternName = private_key_rsa severity = critical line = 1057 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1057patternName = private_key_rsa severity = critical line = 1057 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1189patternName = private_key_openssh severity = critical line = 1189 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1189

dist/chunk-AXFO3IQH.mjsView file

1036patternName = private_key_rsa severity = critical line = 1036 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1036

1168patternName = private_key_openssh severity = critical line = 1168 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1168

README.mdView file

536patternName = generic_password severity = medium line = 536 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L536

547patternName = generic_password severity = medium line = 547 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L547

596patternName = generic_password severity = medium line = 596 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L596

Findings

5 Critical6 Medium6 Low

CriticalCritical Secretdist/chunk-AXBPQRG7.js

CriticalSecret Patterndist/chunk-AXBPQRG7.js

CriticalSecret Patterndist/chunk-AXFO3IQH.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/chunk-AXBPQRG7.jsView file

Lines 1037-1077javascript

1037 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1038 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1039 /* @__PURE__ */ jsxRuntime.jsx(

1040 "textarea",

1041 {

1042 value: clientCert,

1043 onChange: (e) => setClientCert(e.target.value),

1044 placeholder: "-----BEGIN CERTIFICATE-----\nOptional client cert...\n-----END CERTIFICATE-----",

1045 rows: 3,

1046 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1047 }

1048 )

1049 ] }),

1050 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1051 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Private Key (PEM)" }),

1052 /* @__PURE__ */ jsxRuntime.jsx(

1053 "textarea",

1054 {

1055 value: clientKey,

1056 onChange: (e) => setClientKey(e.target.value),

1057 placeholder: "-----BEGIN PRIVATE KEY-----\nOptional client key...\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1058 rows: 3,

1059 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1060 }

1061 )

1062 ] })

1063 ] })

1064 ] })

1065 ] })

1066 }

1067 ) }),

1068 /* @__PURE__ */ jsxRuntime.jsxs(

1069 "button",

1070 {

1071 type: "button",

1072 onClick: () => setShowSSH(!showSSH),

1073 className: "flex items-center gap-2 w-full px-3 py-2 rounded-lg border border-white/5 hover:border-white/10 bg-zinc-900/30 text-xs font-medium text-zinc-400 hover:text-zinc-200 transition-all",

1074 children: [

1075 /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Terminal, { strokeWidth: 1.5, className: "w-3.5 h-3.5 text-purple-500" }),

1076 /* @__PURE__ */ jsxRuntime.jsx("span", { children: "SSH Tunnel" }),

1077 sshEnabled && /* @__PURE__ */ jsxRuntime.jsx("span", { className: "ml-1 px-1.5 py-0.5 rounded text-[0.625rem] bg-purple-500/10 text-purple-400 border border-purple-500/20", children: "ON" }),

Lines 1169-1209javascript

1169 sshAuthMethod === "password" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1170 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1171 /* @__PURE__ */ jsxRuntime.jsx(

1172 chunkEGAZAL6X_js.Input,

1173 {

1174

dist/chunk-AXFO3IQH.mjsView file

Lines 1016-1056javascript

1016 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1017 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1018 /* @__PURE__ */ jsx(

1019 "textarea",

1020 {

README.mdView file

Lines 516-567markdown

516- Hot-reload: config changes apply within 60s without restart

517- Works with Docker, docker-compose, and Kubernetes (Helm)

518

519**1. Create a config file** (`seed-connections.yaml`):

520

521```yaml

522version: "1"

523

524defaults:

525 managed: true

Lines 1148-1188javascript

1148 sshAuthMethod === "password" ? /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1149 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1150 /* @__PURE__ */ jsx(

1151 Input,

1152 {

1153 type: "password",

1154 value: sshPassword,

1155 onChange: (e) => setSSHPassword(e.target.value),

1156 placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",

1157 className: "h-9 bg-zinc-900/50 border-white/5 focus:border-purple-500/50 text-xs"

1158 }

1159 )

1160 ] }) : /* @__PURE__ */ jsxs("div", { className: "space-y-3", children: [

1161 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1162 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Private Key (PEM)" }),

1163 /* @__PURE__ */ jsx(

1164 "textarea",

1165 {

1166 value: sshPrivateKey,

1167 onChange: (e) => setSSHPrivateKey(e.target.value),

1168 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\nPaste private key here...\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1168

1169 rows: 4,

1170 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-purple-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1171 }

1172 )

1173 ] }),

1174 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1175 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Passphrase (optional)" }),

1176 /* @__PURE__ */ jsx(

1177 Input,

1178 {

1179 type: "password",

1180 value: sshPassphrase,

1181 onChange: (e) => setSSHPassphrase(e.target.value),

1182 placeholder: "Key passphrase (if encrypted)",

1183 className: "h-9 bg-zinc-900/50 border-white/5 focus:border-purple-500/50 text-xs"

1184 }

1185 )

1186 ] })

1187 ] })

1188 ] })