registry / @skalfa/skalfa-api-core / 1.0.13

@skalfa/skalfa-api-core@1.0.13

Core framework engine and foundational utilities for the Skalfa API backend.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Risky primitives are framework CLI/database/code-generation features activated by explicit user commands, not install-time behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI/framework method invocation by the user or application

Impact

Can modify project files or databases as documented framework operations, including destructive fresh migrations when explicitly run

Mechanism

user-invoked shell/database/code-generation utilities

Rationale

Static inspection found potentially dangerous primitives, but they are package-aligned framework commands and database migration helpers with no lifecycle trigger, exfiltration, persistence, or foreign agent control-surface mutation. The scanner hints are explained by user-invoked CLI behavior rather than malicious package behavior.

Evidence

package.jsondist/index.jsdist/commands/cli.jsdist/commands/runner/barrels.jsdist/commands/runner/migration.jsdist/commands/runner/da-migration.jsdist/commands/runner/blueprint/runner.js

Network endpoints3

127.0.0.1:8123DB_HOST:DB_PORT from environmentDA_HOST:DA_PORT from environment

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/cli.js exposes user-invoked commands that spawn shell commands with shell:true
dist/commands/runner/barrels.js runs bunx barrelsby when barrels/watch:barrels CLI actions are invoked
dist/commands/runner/migration.js and da-migration.js dynamically import project migration files and can drop database tables on explicit fresh commands

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks and no bin entry
dist/index.js only re-exports modules; no network, shell, or file mutation occurs on import beyond module initialization
Network/database endpoints are local or env-configured DB targets, not hardcoded exfiltration endpoints
Project file writes are framework code generation/storage/logging paths under app, database, storage, docs, or blueprints
No AI-agent control-surface writes, credential harvesting, persistence, or remote payload loading found

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 150 file(s), 332 KB of source, external domains: schema.getpostman.com

Source & flagged code

5 flagged

dist/commands/runner/da-migration.jsView file

Lines 11-51javascript

11// ## Create Migration Table

12// ================================

13async function ensureMigrationTable() {

14 if (!da) {

15 logger.error("ClickHouse connection (da) is not available. Ensure @skalfa/da is installed.");

16 process.exit(1);

17 }

18 await da.exec(`

19 CREATE TABLE IF NOT EXISTS ${MIGRATION_TABLE} (

20 name String,

21 executed_at DateTime DEFAULT now()

22 )

23 ENGINE = MergeTree()

24 ORDER BY (name)

25 `);

26}

27// ================================

28// ## Ensure OLAP Database Exists

29// ================================

30async function ensureDatabaseExists() {

31 // @ts-ignore

32 const { createClient } = await import("@clickhouse/client");

33 let dac = createClient({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/runner/da-migration.jsView on unpkg · L31

34 url: "http://" + (process.env.DA_HOST || '127.0.0.1') + ':' + (process.env.DA_PORT || '8123'),

35 username: process.env.DA_USERNAME || 'default',

36 password: process.env.DA_PASSWORD || '',

37 });

38 logger.info(`Database ${process.env.DA_DATABASE || "default"} not found. Create new database...`);

39 await dac.query({ query: `CREATE DATABASE IF NOT EXISTS ${process.env.DA_DATABASE || "default"}` });

40 logger.info(`Database ${process.env.DA_DATABASE || "default"} successfully created.`);

41}

42// ================================

43// ## GET LIST OF APPLIED MIGRATIONS

44// ================================

45async function getMigratedNames() {

46 try {

47 const rows = (await da.from("migrations").select("name").get());

48 return rows.map((r) => r.name);

49 }

50 catch {

51 return [];

Lines 143-183javascript

143 return [];

144 const entries = fs.readdirSync(dir, { withFileTypes: true });

145 let files = [];

146 for (const entry of entries) {

147 const fullPath = path.join(dir, entry.name);

dist/commands/cli.jsView file

Lines 65-105javascript

65 program.addCommand(daMigrateCommand);

66 program.addCommand(daMigrateFreshCommand);

67 }

68 program.addCommand(devCommand);

69 program.addCommand(watchCommand);

70 program.addCommand(startCommand);

71 program.addCommand(testCommand);

72 program.addCommand(lintCommand);

dist/commands/runner/barrels.jsView file

Lines 1-39javascript

1import fs from "fs";

2import path from "path";

3import { exec, execSync } from "child_process";

4import { Command } from "commander";

5import { logger } from "@utils";

Source & flagged code

5 flagged · loading source

dist/commands/runner/da-migration.jsView file

163} L164: async exec(query) { L165: if (!daClient) {

High

Child Process

Package source references child process execution.

dist/commands/runner/da-migration.jsView on unpkg · L163

31// @ts-ignore L32: const { createClient } = await import("@clickhouse/client"); L33: let dac = createClient({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/runner/da-migration.jsView on unpkg · L31

dist/commands/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @skalfa/sk[redacted]@1.0.9 matchedIdentity = npm:QHNrYWxmYS9za2FsZmEtYXBpLWNvcmU:1.0.9 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg

85function executeCommand(commandLine) { L86: const child = spawn(commandLine, { stdio: "inherit", shell: true }); L87: child.on("exit", (code) => {

High

Shell

Package source references shell execution.

dist/commands/cli.jsView on unpkg · L85

dist/commands/runner/barrels.jsView file

19try { L20: execSync("bunx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L21: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/runner/barrels.jsView on unpkg · L19

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/cli.js

HighChild Processdist/commands/runner/da-migration.js

HighShelldist/commands/cli.js

HighRuntime Package Installdist/commands/runner/barrels.js

MediumDynamic Requiredist/commands/runner/da-migration.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/commands/runner/da-migration.jsView file

Lines 11-51javascript

11// ## Create Migration Table

12// ================================

13async function ensureMigrationTable() {

14 if (!da) {

15 logger.error("ClickHouse connection (da) is not available. Ensure @skalfa/da is installed.");

16 process.exit(1);

17 }

18 await da.exec(`

19 CREATE TABLE IF NOT EXISTS ${MIGRATION_TABLE} (

20 name String,

21 executed_at DateTime DEFAULT now()

22 )

23 ENGINE = MergeTree()

24 ORDER BY (name)

25 `);

26}

27// ================================

28// ## Ensure OLAP Database Exists

29// ================================

30async function ensureDatabaseExists() {

31 // @ts-ignore

32 const { createClient } = await import("@clickhouse/client");

33 let dac = createClient({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/runner/da-migration.jsView on unpkg · L31

34 url: "http://" + (process.env.DA_HOST || '127.0.0.1') + ':' + (process.env.DA_PORT || '8123'),

35 username: process.env.DA_USERNAME || 'default',

36 password: process.env.DA_PASSWORD || '',

37 });

38 logger.info(`Database ${process.env.DA_DATABASE || "default"} not found. Create new database...`);

39 await dac.query({ query: `CREATE DATABASE IF NOT EXISTS ${process.env.DA_DATABASE || "default"}` });

40 logger.info(`Database ${process.env.DA_DATABASE || "default"} successfully created.`);

41}

42// ================================

43// ## GET LIST OF APPLIED MIGRATIONS

44// ================================

45async function getMigratedNames() {

46 try {

47 const rows = (await da.from("migrations").select("name").get());

48 return rows.map((r) => r.name);

49 }

50 catch {

51 return [];

Lines 143-183javascript

143 return [];

144 const entries = fs.readdirSync(dir, { withFileTypes: true });

145 let files = [];

146 for (const entry of entries) {

147 const fullPath = path.join(dir, entry.name);

dist/commands/cli.jsView file

Lines 65-105javascript

65 program.addCommand(daMigrateCommand);

66 program.addCommand(daMigrateFreshCommand);

67 }

68 program.addCommand(devCommand);

69 program.addCommand(watchCommand);

70 program.addCommand(startCommand);

71 program.addCommand(testCommand);

72 program.addCommand(lintCommand);

dist/commands/runner/barrels.jsView file

Lines 1-39javascript

1import fs from "fs";

2import path from "path";

3import { exec, execSync } from "child_process";

4import { Command } from "commander";

5import { logger } from "@utils";