registry / @libredb/studio / 0.9.41

@libredb/studio@0.9.41

No runnable server (bin) in these versions. Use Node 24+ (or an explicit @latest spec) so npx resolves the current release.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Network and secret-looking strings are aligned with a database studio: user-configured DB/SSH connections, local app API routes, and LLM provider calls.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports package APIs or uses the studio components/providers

Impact

No install-time execution, credential harvesting, persistence, or agent control-surface mutation identified

Mechanism

database/LLM provider library with UI components

Rationale

Static inspection shows a legitimate database studio package with user-invoked database, SSH tunnel, and LLM functionality; the scanner's network/env/secret hits are package-aligned configuration, examples, or UI handling. There is no lifecycle-triggered mutation, exfiltration, remote code execution, persistence, or AI-agent control hijack behavior.

Evidence

package.jsondist/index.jsdist/chunk-ZOZ6ZI3L.jsdist/chunk-CVK3CTLF.jsdist/openai-NKS4RCTB.jsdist/ollama-PWPXZEF2.jsdist/chunk-AXBPQRG7.jsdist/libredb-F3HZSQDL.jsdist/sqlite-6OENYVID.jsREADME.md

Network endpoints2

api.openai.com/v1localhost:11434/v1

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall/preinstall/prepare hook; only prepublishOnly build/check script
dist/index.js only re-exports provider and React component APIs
dist/chunk-ZOZ6ZI3L.js registers SIGTERM/SIGINT cleanup and creates DB/LLM providers only when called
dist/chunk-ZOZ6ZI3L.js SSH tunnel is user-configured for database connections, not persistence or exfiltration
dist/openai-NKS4RCTB.js and dist/ollama-PWPXZEF2.js call configured LLM chat endpoints for user-invoked AI features
dist/chunk-AXBPQRG7.js handles connection strings/password form state and local app API calls

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 56 file(s), 1.65 MB of source, external domains: api.openai.com, example.com, picsum.photos

Source & flagged code

8 flagged

dist/chunk-AXBPQRG7.jsView file

Lines 1037-1077javascript

1037 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1038 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1039 /* @__PURE__ */ jsxRuntime.jsx(

1040 "textarea",

1041 {

1042 value: clientCert,

1043 onChange: (e) => setClientCert(e.target.value),

1044 placeholder: "-----BEGIN CERTIFICATE-----\nOptional client cert...\n-----END CERTIFICATE-----",

1045 rows: 3,

1046 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1047 }

1048 )

1049 ] }),

1050 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1051 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Private Key (PEM)" }),

1052 /* @__PURE__ */ jsxRuntime.jsx(

1053 "textarea",

1054 {

1055 value: clientKey,

1056 onChange: (e) => setClientKey(e.target.value),

1057 placeholder: "-----BEGIN PRIVATE KEY-----\nOptional client key...\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1058 rows: 3,

1059 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1060 }

1061 )

1062 ] })

1063 ] })

1064 ] })

1065 ] })

1066 }

1067 ) }),

1068 /* @__PURE__ */ jsxRuntime.jsxs(

1069 "button",

1070 {

1071 type: "button",

1072 onClick: () => setShowSSH(!showSSH),

1073 className: "flex items-center gap-2 w-full px-3 py-2 rounded-lg border border-white/5 hover:border-white/10 bg-zinc-900/30 text-xs font-medium text-zinc-400 hover:text-zinc-200 transition-all",

1074 children: [

1075 /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Terminal, { strokeWidth: 1.5, className: "w-3.5 h-3.5 text-purple-500" }),

1076 /* @__PURE__ */ jsxRuntime.jsx("span", { children: "SSH Tunnel" }),

1077 sshEnabled && /* @__PURE__ */ jsxRuntime.jsx("span", { className: "ml-1 px-1.5 py-0.5 rounded text-[0.625rem] bg-purple-500/10 text-purple-400 border border-purple-500/20", children: "ON" }),

Lines 1169-1209javascript

1169 sshAuthMethod === "password" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1170 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1171 /* @__PURE__ */ jsxRuntime.jsx(

1172 chunkEGAZAL6X_js.Input,

1173 {

1174

dist/chunk-AXFO3IQH.mjsView file

Lines 1016-1056javascript

1016 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1017 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1018 /* @__PURE__ */ jsx(

1019 "textarea",

1020 {

README.mdView file

Lines 524-575markdown

524- Hot-reload: config changes apply within 60s without restart

525- Works with Docker, docker-compose, and Kubernetes (Helm)

526

527**1. Create a config file** (`seed-connections.yaml`):

528

529```yaml

530version: "1"

531

532defaults:

533 managed: true

Source & flagged code

8 flagged · loading source

dist/chunk-AXBPQRG7.jsView file

1057patternName = private_key_rsa severity = critical line = 1057 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1057patternName = private_key_rsa severity = critical line = 1057 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1189patternName = private_key_openssh severity = critical line = 1189 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1189

dist/chunk-AXFO3IQH.mjsView file

1036patternName = private_key_rsa severity = critical line = 1036 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1036

1168patternName = private_key_openssh severity = critical line = 1168 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1168

README.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L544

555patternName = generic_password severity = medium line = 555 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L555

604patternName = generic_password severity = medium line = 604 matchedText = password...RD}"

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L604

Findings

5 Critical6 Medium6 Low

CriticalCritical Secretdist/chunk-AXBPQRG7.js

CriticalSecret Patterndist/chunk-AXBPQRG7.js

CriticalSecret Patterndist/chunk-AXFO3IQH.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/chunk-AXBPQRG7.jsView file

Lines 1037-1077javascript

1037 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1038 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1039 /* @__PURE__ */ jsxRuntime.jsx(

1040 "textarea",

1041 {

1042 value: clientCert,

1043 onChange: (e) => setClientCert(e.target.value),

1044 placeholder: "-----BEGIN CERTIFICATE-----\nOptional client cert...\n-----END CERTIFICATE-----",

1045 rows: 3,

1046 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1047 }

1048 )

1049 ] }),

1050 /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1051 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Private Key (PEM)" }),

1052 /* @__PURE__ */ jsxRuntime.jsx(

1053 "textarea",

1054 {

1055 value: clientKey,

1056 onChange: (e) => setClientKey(e.target.value),

1057 placeholder: "-----BEGIN PRIVATE KEY-----\nOptional client key...\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

Critical

Secret Pattern

RSA private key in dist/chunk-AXBPQRG7.js

dist/chunk-AXBPQRG7.jsView on unpkg · L1057

1058 rows: 3,

1059 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-emerald-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1060 }

1061 )

1062 ] })

1063 ] })

1064 ] })

1065 ] })

1066 }

1067 ) }),

1068 /* @__PURE__ */ jsxRuntime.jsxs(

1069 "button",

1070 {

1071 type: "button",

1072 onClick: () => setShowSSH(!showSSH),

1073 className: "flex items-center gap-2 w-full px-3 py-2 rounded-lg border border-white/5 hover:border-white/10 bg-zinc-900/30 text-xs font-medium text-zinc-400 hover:text-zinc-200 transition-all",

1074 children: [

1075 /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Terminal, { strokeWidth: 1.5, className: "w-3.5 h-3.5 text-purple-500" }),

1076 /* @__PURE__ */ jsxRuntime.jsx("span", { children: "SSH Tunnel" }),

1077 sshEnabled && /* @__PURE__ */ jsxRuntime.jsx("span", { className: "ml-1 px-1.5 py-0.5 rounded text-[0.625rem] bg-purple-500/10 text-purple-400 border border-purple-500/20", children: "ON" }),

Lines 1169-1209javascript

1169 sshAuthMethod === "password" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1.5", children: [

1170 /* @__PURE__ */ jsxRuntime.jsx(chunkEGAZAL6X_js.Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1171 /* @__PURE__ */ jsxRuntime.jsx(

1172 chunkEGAZAL6X_js.Input,

1173 {

1174

dist/chunk-AXFO3IQH.mjsView file

Lines 1016-1056javascript

1016 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1017 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Client Certificate (PEM)" }),

1018 /* @__PURE__ */ jsx(

1019 "textarea",

1020 {

README.mdView file

Lines 524-575markdown

524- Hot-reload: config changes apply within 60s without restart

525- Works with Docker, docker-compose, and Kubernetes (Helm)

526

527**1. Create a config file** (`seed-connections.yaml`):

528

529```yaml

530version: "1"

531

532defaults:

533 managed: true

Lines 1148-1188javascript

1148 sshAuthMethod === "password" ? /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1149 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "SSH Password" }),

1150 /* @__PURE__ */ jsx(

1151 Input,

1152 {

1153 type: "password",

1154 value: sshPassword,

1155 onChange: (e) => setSSHPassword(e.target.value),

1156 placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",

1157 className: "h-9 bg-zinc-900/50 border-white/5 focus:border-purple-500/50 text-xs"

1158 }

1159 )

1160 ] }) : /* @__PURE__ */ jsxs("div", { className: "space-y-3", children: [

1161 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1162 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Private Key (PEM)" }),

1163 /* @__PURE__ */ jsx(

1164 "textarea",

1165 {

1166 value: sshPrivateKey,

1167 onChange: (e) => setSSHPrivateKey(e.target.value),

1168 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\nPaste private key here...\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/chunk-AXFO3IQH.mjs

dist/chunk-AXFO3IQH.mjsView on unpkg · L1168

1169 rows: 4,

1170 className: "w-full rounded-md bg-zinc-900/50 border border-white/5 focus:border-purple-500/50 text-xs font-mono text-zinc-300 p-2 resize-none placeholder:text-zinc-600"

1171 }

1172 )

1173 ] }),

1174 /* @__PURE__ */ jsxs("div", { className: "space-y-1.5", children: [

1175 /* @__PURE__ */ jsx(Label, { className: "text-xs font-mediumr text-zinc-500", children: "Passphrase (optional)" }),

1176 /* @__PURE__ */ jsx(

1177 Input,

1178 {

1179 type: "password",

1180 value: sshPassphrase,

1181 onChange: (e) => setSSHPassphrase(e.target.value),

1182 placeholder: "Key passphrase (if encrypted)",

1183 className: "h-9 bg-zinc-900/50 border-white/5 focus:border-purple-500/50 text-xs"

1184 }

1185 )

1186 ] })

1187 ] })

1188 ] })