registry / @storm-orm/cli / 1.12.1

@storm-orm/cli@1.12.1

Storm ORM - AI assistant configuration tool

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 109 KB of source, external domains: orm.st

Source & flagged code

2 flagged

storm.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Storm CLI - AI assistant configuration tool

3// https://orm.st

4//

5// Zero dependencies. Requires Node.js 18+.

7import { writeFileSync, appendFileSync, mkdirSync, existsSync, readFileSync, readdirSync, unlinkSync, rmdirSync, statSync } from 'fs';

8import { basename, join, dirname } from 'path';

Source & flagged code

2 flagged · loading source

storm.mjsView file

9import { homedir } from 'os'; L10: import { execSync, spawn } from 'child_process'; L11:

High

Child Process

Package source references child process execution.

storm.mjsView on unpkg · L9

780try { L781: execSync(`npm install ${driverPackage} --prefix "${globalDir}"`, { L782: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

storm.mjsView on unpkg · L780

Findings

3 High2 Medium3 Low

HighChild Processstorm.mjs

HighShell

HighRuntime Package Installstorm.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 760-800javascript

760

761 const packageJsonPath = join(globalDir, 'package.json');

762 if (!existsSync(packageJsonPath)) {

763 writeFileSync(packageJsonPath, '{"private":true}\n');

764 }

765

766 // Always overwrite server.mjs to keep in sync with CLI version.

767 writeFileSync(join(globalDir, 'server.mjs'), MCP_SERVER_SOURCE);

768 return globalDir;

769}

770

771function installDriver(dialect) {

772 const globalDir = join(homedir(), '.storm');

773 const driverPackage = DIALECTS[dialect].driver;

774

775 // Skip if driver is already installed.

776 const driverDir = join(globalDir, 'node_modules', driverPackage);

777 if (existsSync(driverDir)) return true;

778

779 console.log(dimText(` Installing ${DIALECTS[dialect].name} driver...`));

780 try {

781 execSync(`npm install ${driverPackage} --prefix "${globalDir}"`, {

782 stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

storm.mjsView on unpkg · L780

783 timeout: 60000,

784 });

785 return true;

786 } catch (error) {

787 console.log(boltYellow(' Failed to install driver. Make sure npm is available.'));

788 console.log(dimText(' ' + (error.stderr?.toString().trim() || error.message)));

789 return false;

790 }

791}

792

793function listGlobalConnections() {

794 const connectionsDir = join(homedir(), '.storm', 'connections');

795 if (!existsSync(connectionsDir)) return [];

796 return readdirSync(connectionsDir)

797 .filter(f => f.endsWith('.json'))

798 .map(f => f.replace(/\.json$/, ''));

799}

800