registry / @metasession.co/devaudit-plugin-prisma / 0.3.5

@metasession.co/devaudit-plugin-prisma@0.3.5

Prisma migration deploy hooks + status commands for DevAudit-onboarded node consumers.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 3.63 KB of source

Source & flagged code

2 flagged

dist/plugin.jsView file

Lines 1-50javascript

1import { execa } from 'execa';

2import { promises } from 'fs';

High

Shell

Package source references shell execution.

dist/plugin.jsView on unpkg · L1

3import { join } from 'path';

5// src/commands/migrate-status.ts

6var SCHEMA_FILE = "prisma/schema.prisma";

7var MIGRATIONS_DIR = "prisma/migrations";

8async function pathExists(path) {

9 try {

10 await promises.access(path);

11 return true;

12 } catch {

13 return false;

14 }

15}

16async function detectPrismaLayout(projectPath) {

17 return {

18 schemaExists: await pathExists(join(projectPath, SCHEMA_FILE)),

19 migrationsExists: await pathExists(join(projectPath, MIGRATIONS_DIR))

20 };

21}

23// src/commands/migrate-status.ts

24async function migrateStatus(ctx) {

25 const layout = await detectPrismaLayout(ctx.projectPath);

26 if (!layout.schemaExists) {

27 ctx.logger.warn(`No ${SCHEMA_FILE} in ${ctx.projectPath} \u2014 nothing to check.`);

28 return;

29 }

30 ctx.logger.info(`Running \`npx prisma migrate status\` in ${ctx.projectPath}...`);

31 const res = await execa("npx", ["prisma", "migrate", "status"], {

32 cwd: ctx.projectPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/plugin.jsView on unpkg · L30

33 reject: false,

34 stdio: "inherit"

35 });

36 if (res.exitCode === 0) {

37 ctx.logger.info("Migrations are up to date.");

38 } else {

39 ctx.logger.warn(`prisma migrate status exited ${res.exitCode}. See output above.`);

40 }

41}

42async function listMigrations(projectPath) {

43 const dir = join(projectPath, MIGRATIONS_DIR);

44 const entries = await promises.readdir(dir, { withFileTypes: true });

45 const migrations = [];

46 for (const e of entries) {

47 if (!e.isDirectory()) continue;

48 const appliedMarker = join(dir, e.name, "migration.sql");

49 let applied = true;

50 try {

Source & flagged code

2 flagged · loading source

dist/plugin.jsView file

1import { execa } from 'execa'; L2: import { promises } from 'fs';

High

Shell

Package source references shell execution.

dist/plugin.jsView on unpkg · L1

30ctx.logger.info(`Running \`npx prisma migrate status\` in ${ctx.projectPath}...`); L31: const res = await execa("npx", ["prisma", "migrate", "status"], { L32: cwd: ctx.projectPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/plugin.jsView on unpkg · L30

Findings

2 High2 Low

HighShelldist/plugin.js

HighRuntime Package Installdist/plugin.js

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

dist/plugin.jsView file

Lines 1-50javascript

1import { execa } from 'execa';

2import { promises } from 'fs';

High

Shell

Package source references shell execution.

dist/plugin.jsView on unpkg · L1

3import { join } from 'path';

5// src/commands/migrate-status.ts

6var SCHEMA_FILE = "prisma/schema.prisma";

7var MIGRATIONS_DIR = "prisma/migrations";

8async function pathExists(path) {

9 try {

10 await promises.access(path);

11 return true;

12 } catch {

13 return false;

14 }

15}

16async function detectPrismaLayout(projectPath) {

17 return {

18 schemaExists: await pathExists(join(projectPath, SCHEMA_FILE)),

19 migrationsExists: await pathExists(join(projectPath, MIGRATIONS_DIR))

20 };

21}

23// src/commands/migrate-status.ts

24async function migrateStatus(ctx) {

25 const layout = await detectPrismaLayout(ctx.projectPath);

26 if (!layout.schemaExists) {

27 ctx.logger.warn(`No ${SCHEMA_FILE} in ${ctx.projectPath} \u2014 nothing to check.`);

28 return;

29 }

30 ctx.logger.info(`Running \`npx prisma migrate status\` in ${ctx.projectPath}...`);

31 const res = await execa("npx", ["prisma", "migrate", "status"], {

32 cwd: ctx.projectPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/plugin.jsView on unpkg · L30

33 reject: false,

34 stdio: "inherit"

35 });

36 if (res.exitCode === 0) {

37 ctx.logger.info("Migrations are up to date.");

38 } else {

39 ctx.logger.warn(`prisma migrate status exited ${res.exitCode}. See output above.`);

40 }

41}

42async function listMigrations(projectPath) {

43 const dir = join(projectPath, MIGRATIONS_DIR);

44 const entries = await promises.readdir(dir, { withFileTypes: true });

45 const migrations = [];

46 for (const e of entries) {

47 if (!e.isDirectory()) continue;

48 const appliedMarker = join(dir, e.name, "migration.sql");

49 let applied = true;

50 try {