registry / @libredb/studio / 0.9.39

@libredb/studio@0.9.39

No runnable server (bin) in these versions. Use Node 24+ (or an explicit @latest spec) so npx resolves the current release.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and filesystem behavior is aligned with a database studio library: user-invoked DB connections, optional SSH tunnel, optional LLM provider calls, and SQLite file creation for configured DB paths.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports library and calls provider/UI functionality with connection or LLM configuration.

Impact

Connects to user-configured services and may create/open a configured SQLite database; no unconsented install-time behavior found.

Mechanism

package-aligned database, SSH tunnel, SQLite, and LLM provider operations

Rationale

Static inspection shows a legitimate LibreDB Studio library bundle with database/LLM functionality and no install-time execution, persistence, broad agent-control mutation, or credential exfiltration. Scanner secret/network findings are explained by documented example credentials and package-aligned runtime connectors.

Evidence

package.jsondist/index.jsdist/chunk-ZOZ6ZI3L.jsdist/chunk-CVK3CTLF.jsdist/openai-NKS4RCTB.jsdist/custom-ZAYXQ67P.jsdist/sqlite-6OENYVID.jsREADME.md

Network endpoints4

api.openai.com/v1localhost:11434/v1/api/ai/chat/api/db/test-connection

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

Database/LLM package can connect to user-configured DBs and LLM APIs at runtime.
SQLite provider creates directories for the user-specified database path.

Evidence against

package.json has no install/postinstall/preinstall hooks; prepublishOnly is publisher-only.
dist/index.js only re-exports bundled providers/components.
dist/chunk-ZOZ6ZI3L.js creates DB/SSH/LLM providers only when called by consumers.
dist/chunk-CVK3CTLF.js reads LLM_* env vars and masks apiKey in logging.
dist/openai-NKS4RCTB.js and custom provider send API keys only as Authorization to configured LLM endpoint.
No AI-agent control-surface writes, lifecycle persistence, credential harvesting, or exfiltration code found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 56 file(s), 1.65 MB of source, external domains: api.openai.com, example.com, picsum.photos

Source & flagged code

8 flagged

dist/chunk-AXBPQRG7.jsView file

Lines 1037-1077javascript

1037 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1038 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1039 /* @__PURE__ */ jsxRuntime.jsx(

1040 "textarea",

1041 {

1042 value: clientCert,

1043 onChange: (e) => setClientCert(e.target.value),

1044 placeholder: "-----BEGIN CERTIFICATE-----\nOptional client cert...\n-----END CERTIFICATE-----",

1045 rows: 3,

1046 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1047 }

1048 )

1049 ] }),

1050 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1051 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Private Key (PEM)" }),

1052 /* @__PURE__ */ jsxRuntime.jsx(

1053 "textarea",

1054 {

1055 value: clientKey,

1056 onChange: (e) => setClientKey(e.target.value),

1057 placeholder: "-----BEGIN PRIVATE KEY-----\nOptional client key...\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1058 rows: 3,

1059 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1060 }

1061 )

1062 ] })

1063 ] })

1064 ] })

1065 ] })

1066 }

1067 ) }),

1068 /* @__PURE__ */ jsxRuntime.jsxs(

1069 "button",

1070 {

1071 type: "button",

1072 onClick: () => setShowSSH(!showSSH),

1073 className: "flex items-center gap-2 w-full px-3 py-2 rounded-lg border border-white/5 hover:border-white/10 bg-zinc-900/30 text-xs font-medium text-zinc-400 hover:text-zinc-200 transition-all",

1074 children: [

1075 /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Terminal, { strokeWidth: 1.5, className: "w-3.5 h-3.5 text-purple-500" }),

1076 /* @__PURE__ */ jsxRuntime.jsx("span", { children: "SSH Tunnel" }),

1077 sshEnabled && /* @__PURE__ */ jsxRuntime.jsx("span", { className: "ml-1 px-1.5 py-0.5 rounded text-[0.625rem] bg-purple-500/10 text-purple-400 border border-purple-500/20", children: "ON" }),

Lines 1169-1209javascript

1169 sshAuthMethod === "password" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1170 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1171 /* @__PURE__ */ jsxRuntime.jsx(

1172 chunkEGAZAL6X_js.Input,

1173 {

1174

dist/chunk-AXFO3IQH.mjsView file

Lines 1016-1056javascript

1016 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1017 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1018 /* @__PURE__ */ jsx(

1019 "textarea",

1020 {

README.mdView file

Lines 516-567markdown

516- Hot-reload: config changes apply within 60s without restart

517- Works with Docker, docker-compose, and Kubernetes (Helm)

518

519**1. Create a config file** (`seed-connections.yaml`):

520

521```yaml

522version: "1"

523

524defaults:

525 managed: true

Source & flagged code

8 flagged · loading source

dist/chunk-AXBPQRG7.jsView file

1057patternName = private_key_rsa severity = critical line = 1057 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1057patternName = private_key_rsa severity = critical line = 1057 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1189patternName = private_key_openssh severity = critical line = 1189 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1189

dist/chunk-AXFO3IQH.mjsView file

1036patternName = private_key_rsa severity = critical line = 1036 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1036

1168patternName = private_key_openssh severity = critical line = 1168 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1168

README.mdView file

536patternName = generic_password severity = medium line = 536 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L536

547patternName = generic_password severity = medium line = 547 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L547

596patternName = generic_password severity = medium line = 596 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L596

Findings

5 Critical6 Medium6 Low

CriticalCritical Secretdist/chunk-AXBPQRG7.js

CriticalSecret Patterndist/chunk-AXBPQRG7.js

CriticalSecret Patterndist/chunk-AXFO3IQH.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/chunk-AXBPQRG7.jsView file

Lines 1037-1077javascript

1037 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1038 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1039 /* @__PURE__ */ jsxRuntime.jsx(

1040 "textarea",

1041 {

1042 value: clientCert,

1043 onChange: (e) => setClientCert(e.target.value),

1044 placeholder: "-----BEGIN CERTIFICATE-----\nOptional client cert...\n-----END CERTIFICATE-----",

1045 rows: 3,

1046 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1047 }

1048 )

1049 ] }),

1050 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1051 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Private Key (PEM)" }),

1052 /* @__PURE__ */ jsxRuntime.jsx(

1053 "textarea",

1054 {

1055 value: clientKey,

1056 onChange: (e) => setClientKey(e.target.value),

1057 placeholder: "-----BEGIN PRIVATE KEY-----\nOptional client key...\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1058 rows: 3,

1059 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1060 }

1061 )

1062 ] })

1063 ] })

1064 ] })

1065 ] })

1066 }

1067 ) }),

1068 /* @__PURE__ */ jsxRuntime.jsxs(

1069 "button",

1070 {

1071 type: "button",

1072 onClick: () => setShowSSH(!showSSH),

1073 className: "flex items-center gap-2 w-full px-3 py-2 rounded-lg border border-white/5 hover:border-white/10 bg-zinc-900/30 text-xs font-medium text-zinc-400 hover:text-zinc-200 transition-all",

1074 children: [

1075 /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Terminal, { strokeWidth: 1.5, className: "w-3.5 h-3.5 text-purple-500" }),

1076 /* @__PURE__ */ jsxRuntime.jsx("span", { children: "SSH Tunnel" }),

1077 sshEnabled && /* @__PURE__ */ jsxRuntime.jsx("span", { className: "ml-1 px-1.5 py-0.5 rounded text-[0.625rem] bg-purple-500/10 text-purple-400 border border-purple-500/20", children: "ON" }),

Lines 1169-1209javascript

1169 sshAuthMethod === "password" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1170 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1171 /* @__PURE__ */ jsxRuntime.jsx(

1172 chunkEGAZAL6X_js.Input,

1173 {

1174

dist/chunk-AXFO3IQH.mjsView file

Lines 1016-1056javascript

1016 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1017 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1018 /* @__PURE__ */ jsx(

1019 "textarea",

1020 {

README.mdView file

Lines 516-567markdown

516- Hot-reload: config changes apply within 60s without restart

517- Works with Docker, docker-compose, and Kubernetes (Helm)

518

519**1. Create a config file** (`seed-connections.yaml`):

520

521```yaml

522version: "1"

523

524defaults:

525 managed: true

Lines 1148-1188javascript

1148 sshAuthMethod === "password" ? /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1149 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1150 /* @__PURE__ */ jsx(

1151 Input,

1152 {

1153 type: "password",

1154 value: sshPassword,

1155 onChange: (e) => setSSHPassword(e.target.value),

1156 placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",

1157 className: "h-9 bg-zinc-900/50 border-white/5 focus:border-purple-500/50 text-xs"

1158 }

1159 )

1160 ] }) : /* @__PURE__ */ jsxs("div", { className: "space-y-3", children: [

1161 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1162 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Private Key (PEM)" }),

1163 /* @__PURE__ */ jsx(

1164 "textarea",

1165 {

1166 value: sshPrivateKey,

1167 onChange: (e) => setSSHPrivateKey(e.target.value),

1168 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\nPaste private key here...\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1168

1169 rows: 4,

1170 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-purple-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1171 }

1172 )

1173 ] }),

1174 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1175 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Passphrase (optional)" }),

1176 /* @__PURE__ */ jsx(

1177 Input,

1178 {

1179 type: "password",

1180 value: sshPassphrase,

1181 onChange: (e) => setSSHPassphrase(e.target.value),

1182 placeholder: "Key passphrase (if encrypted)",

1183 className: "h-9 bg-zinc-900/50 border-white/5 focus:border-purple-500/50 text-xs"

1184 }

1185 )

1186 ] })

1187 ] })

1188 ] })