registry / @telaclaims-tech/prisma-package / 1.0.144

@telaclaims-tech/prisma-package@1.0.144

prisma-package simplifies database management across microservices at Telaclaims by maintaining configurations in one place and integrating with Prisma for efficient and secure SQL database access.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindings

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 2.71 MB of source, external domains: dotenvx.com, github.com, pris.ly, unpkg.com, www.prisma.io

Source & flagged code

4 flagged

dist/prisma-client/runtime/library.jsView file

Lines 1-21javascript

1"use strict";var bu=Object.create;var qt=Object.defineProperty;var Eu=Object.getOwnPropertyDescriptor;var wu=Object.getOwnPropertyNames;var xu=Object.getPrototypeOf,vu=Object.prototype.hasOwnProperty;var Do=(e,r)=>()=>(e&&(r=e(e=0)),r);var ne=(e,r)=>()=>(r||e((r={exports:{}}).exports,r),r.exports),tr=(e,r)=>{for(var t in r)qt(e,t,{get:r[t],enumerable:!0})},_o=(e,r,t,n)=>{if(r&&typeof r=="object"||typeof r=="function")for(let i of wu(r))!vu.call(e,i)&&i!==t&&qt(e,i,{get:()=>r[i],enumerable:!(n=Eu(r,i))||n.enumerable});return e};var k=(e,r,t)=>(t=e!=null?bu(xu(e)):{},_o(r||!e||!e.__esModule?qt(t ...

2`);let n;for(;(n=ip.exec(t))!=null;){let i=n[1],o=n[2]||"";o=o.trim();let s=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),s==='"'&&(o=o.replace(/\\n/g,`

3`),o=o.replace(/\\r/g,"\r")),r[i]=o}return r}function sp(e){let r=ks(e),t=B.configDotenv({path:r});if(!t.parsed){let s=new Error(`MISSING_DATA: Cannot parse ${r} for an unknown reason`);throw s.code="MISSING_DATA"

4`);return r.length<e?r:r.slice(-e)}function Qo(){Kr.length=0}var gr=N;var Wo=k(require("node:fs"));function ii(){let e=process.env.PRISMA_QUERY_ENGINE_LIBRARY;if(!(e&&Wo.default.existsSync(e))&&process.arch==="ia32")throw new Error('The default query engine type (Node-API, "library") is currently not supported for 32bit Node. Please set `engineType = "binary"` in the "generator" block of your "schema.prisma" file (or use the environment variables "PRISMA_CLIENT_ENGINE_TYPE=binary" and/or "PRISMA_CLI_QUERY_ENGINE_TYPE=binary".)')}var oi=["darwin","darwin-arm64","debian-openssl-1.0.x","debian-op ...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/prisma-client/runtime/library.jsView on unpkg · L1

5${JSON.stringify(a,null,2)}`),a}async function Xu(){let e="/etc/os-release";try{let r=await ci.default.readFile(e,{encoding:"utf-8"});return Zu(r)}catch{return{targetDistro:void 0,familyDistro:void 0,originalDistro:void

6${c}`)}let u="debian";if(r==="linux"&&o===void 0&&ee(`Distro is "${a}". Falling back to Prisma engines built for "${u}".`),r==="darwin"&&t==="arm64")return"darwin-arm64";if(r==="darwin")return"darwin";if(r==="win32")return"windows";if(r==="freebsd")return o;if(r==="openbsd")return"openbsd";if(r==="netbsd")return"netbsd";if(r==="linux"&&o==="nixos")return"linux-nixos";if(r==="linux"&&t==="arm64")return`${o==="musl"?"linux-musl-arm64":"linux-arm64"}-openssl-${i||l}`;if(r==="linux"&&t==="arm")return`linux-arm-openssl-${i||l}`;if(r==="linux"&&o==="musl"){let c="linux-musl";return!i||rs(i)?c:`${c}- ...

7${s}

9Details: ${r.message}`}var Es=k(bs(),1);function Ti(e){let r=(0,Es.default)(e);if(r===0)return e;let t=new RegExp(`^[ \\t]{${r}}`,"gm");return e.replace(t,"")}var ws="prisma+postgres",en=`${ws}:`;function Si(e){return e?.startsWith(`${en}//`)??!1}var vs=k(Ri());function Ai(e){return String(new Ci(e))}var Ci=class{constructor(r){this.config=r}toString(){let{config:r}=this,t=r.provider.fromEnvVar?`env("${r.provider.fromEnvVar}")`:r.provider.value,n=JSON.parse(JSON.stringify({provider:t,binaryTargets:Wc(r.binaryTargets)}));return`generator ${r.name} {

10${(0,vs.default)(Jc(n),2)}

11}`}};function Wc(e){let r;if(e.length>0){let t=e.find(n=>n.fromEnvVar!==null);t?r=`env("${t.fromEnvVar}")`:r=e.map(n=>n.native?"native":n.value)}else r=void 0;return r}function Jc(e){let r=Object.keys(e).reduce((t,n)=>Math.max(t,n.length),0);return Object.entries(e).map(([t,n])=>`${t.padEnd(r)} = ${Hc(n)}`).join(`

12`)}function Hc(e){return JSON.parse(JSON.stringify(e,(r,t)=>Array.isArray(t)?`[${t.map(n=>JSON.stringify(n)).join(", ")}]`:JSON.stringify(t)))}var tt={};tr(tt,{error:()=>zc,info:()=>Yc,log:()=>Kc,query:()=>Zc,should:()=>Ps,tags:()=>rt,warn:()=>Ii});var rt={error:ce("prisma:error"),warn:ke("prisma:warn"),info:Oe("prisma:info"),query:nr("prisma:query")},Ps={warn:()=>!process.env.PRISMA_DISABLE_WARNINGS};function Kc(...e){console.log(...e)}function Ii(e,...r){Ps.warn()&&console.warn(`${rt.warn} ${e}`,...r)}function Yc(e,...r){console.info(`${rt.info} ${e}`,...r)}function zc(e,...r){console.error( ...

13`),parsed:{...n?.dotenvResult?.parsed,...i?.dotenvResult?.parsed}}}function gp(e,r,t){let n=e?.dotenvResult.parsed,i=!Ns(e?.path,r);if(n&&r&&i&&nn.default.existsSync(r)){let o=Fi.default.parse(nn.default.readFileSync(r)),s=[];for(let a in o)n[a]===

14Conflicting env vars:

15${s.map(c=>` ${W(c)}`).join(`

16`)}

18We suggest to move the contents of ${Y(l)} to ${Y(a)} to consolidate your env vars.

19`;throw new Error(u)}else if(t==="warn"){let u=`Conflict for env var${s.length>1?"s":""} ${s.map(c=>W(c)).join(", ")} in ${Y(a)} and ${Y(l

20Env vars from ${Y(l)} overwrite the ones from ${Y(a)}

21 `;console.warn(`${ke("warn(prisma)")} ${u}`)}}}}function _s(e){if(hp(e)){Li(`Environment variables loaded from ${e}`);let r=Fi.default.config({path:e,debug:process.env.DOTENV_CONFIG_DEBUG?!0:void 0});return{dotenvResult:Ds(r),message:Ie(`Environment variables loaded from ${

Long lines were clipped for display.

Lines 43-83javascript

43Please help us by answering a few questions: https://pris.ly/${e}`}function Bn(e){let{errorStack:r}=e;return r?.match(/\/\.next|\/next@|\/next\//)?`

45We detected that you are using Next.js, learn how to fix this: https://pris.ly/d/engine-not-found-nextjs.`:""}function ml(e){let{queryEngineName:r}=e;return`${Xe(e)}${Bn(e)}

47This is likely caused by a bundler that has not copied "${r}" next to the resulting bundle.

48Ensure that "${r}" has been copied next to the bundle or in "${e.expectedLocation}".

dist/prisma-client/client.jsView file

Lines 1-1javascript

1module.exports = { ...require('.') }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prisma-client/client.jsView on unpkg · L1

dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.nodeView file

•path = dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.node kind = native_binary sizeBytes = 21192400 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.nodeView on unpkg

Source & flagged code

4 flagged · loading source

dist/prisma-client/runtime/library.jsView file

1"use strict";var bu=Object.create;var qt=Object.defineProperty;var Eu=Object.getOwnPropertyDescriptor;var wu=Object.getOwnPropertyNames;var xu=Object.getPrototypeOf,vu=Object.proto... L2: `);let n;for(;(n=ip.exec(t))!=null;){let i=n[1],o=n[2]||"";o=o.trim();let s=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),s==='"'&&(o=o.replace(/\\n/g,` L3: `),o=o.replace(/\\r/g,"\r")),r[i]=o}return r}function sp(e){let r=ks(e),t=B.configDotenv({path:r});if(!t.parsed){let s=new Error(`MISSING_DATA: Cannot parse ${r} for an unknown rea... L4: `);return r.length<e?r:r.slice(-e)}function Qo(){Kr.length=0}var gr=N;var Wo=k(require("node:fs"));function ii(){let e=process.env.PRISMA_QUERY_ENGINE_LIBRARY;if(!(e&&Wo.default.ex... ... L110: `}function jr({inlineDatasources:e,overrideDatasources:r,env:t,clientVersion:n}){let i,o=Object.keys(e)[0],s=e[o]?.url,a=r[o]?.url;if(o===void 0?i=void 0:a?i=a:s?.value?i=s.value:s... L111: ${r}`,R(t,!0))}};x(Ft,"RequestError");async function pr(e,r,t=n=>n){let{clientVersion:n,...i}=r,o=t(fetch);try{return await o(e,i)}catch(s){let a=s.message??"Unknown error";throw n... L112: You may have to run ${qe("prisma generate")} for your changes to take effect.`,this.con

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/prisma-client/runtime/library.jsView on unpkg · L1

63L64: ${er(e)}`}var Xm=N("prisma:client:engines:resolveEnginePath"),ef=()=>new RegExp("runtime[\\\\/]library\\.m?js$");async function yl(e,r){let t={binary:process.env.PRISMA_QUERY_ENGIN... L65: `).map(r=>r.replace(/^\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d\.\d+([+-][0-2]\d:[0-5]\d|Z)\s*/,"").replace(/\+\d+\s*ms$/,"")).join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/prisma-client/runtime/library.jsView on unpkg · L63

dist/prisma-client/client.jsView file

1module.exports = { ...require('.') }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prisma-client/client.jsView on unpkg · L1

dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.nodeView file

•path = dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.node kind = native_binary sizeBytes = 21192400 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.nodeView on unpkg

Findings

2 High5 Medium5 Low

HighObfuscated Payload Loaderdist/prisma-client/runtime/library.js

HighObfuscated

MediumDynamic Requiredist/prisma-client/client.js

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.node

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/prisma-client/runtime/library.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/prisma-client/runtime/library.jsView file

Lines 1-21javascript

1"use strict";var bu=Object.create;var qt=Object.defineProperty;var Eu=Object.getOwnPropertyDescriptor;var wu=Object.getOwnPropertyNames;var xu=Object.getPrototypeOf,vu=Object.prototype.hasOwnProperty;var Do=(e,r)=>()=>(e&&(r=e(e=0)),r);var ne=(e,r)=>()=>(r||e((r={exports:{}}).exports,r),r.exports),tr=(e,r)=>{for(var t in r)qt(e,t,{get:r[t],enumerable:!0})},_o=(e,r,t,n)=>{if(r&&typeof r=="object"||typeof r=="function")for(let i of wu(r))!vu.call(e,i)&&i!==t&&qt(e,i,{get:()=>r[i],enumerable:!(n=Eu(r,i))||n.enumerable});return e};var k=(e,r,t)=>(t=e!=null?bu(xu(e)):{},_o(r||!e||!e.__esModule?qt(t ...

2`);let n;for(;(n=ip.exec(t))!=null;){let i=n[1],o=n[2]||"";o=o.trim();let s=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),s==='"'&&(o=o.replace(/\\n/g,`

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/prisma-client/runtime/library.jsView on unpkg · L1

7${s}

10${(0,vs.default)(Jc(n),2)}

14Conflicting env vars:

15${s.map(c=>` ${W(c)}`).join(`

16`)}

18We suggest to move the contents of ${Y(l)} to ${Y(a)} to consolidate your env vars.

19`;throw new Error(u)}else if(t==="warn"){let u=`Conflict for env var${s.length>1?"s":""} ${s.map(c=>W(c)).join(", ")} in ${Y(a)} and ${Y(l

20Env vars from ${Y(l)} overwrite the ones from ${Y(a)}

Long lines were clipped for display.

Lines 43-83javascript

43Please help us by answering a few questions: https://pris.ly/${e}`}function Bn(e){let{errorStack:r}=e;return r?.match(/\/\.next|\/next@|\/next\//)?`

45We detected that you are using Next.js, learn how to fix this: https://pris.ly/d/engine-not-found-nextjs.`:""}function ml(e){let{queryEngineName:r}=e;return`${Xe(e)}${Bn(e)}

47This is likely caused by a bundler that has not copied "${r}" next to the resulting bundle.

48Ensure that "${r}" has been copied next to the bundle or in "${e.expectedLocation}".

dist/prisma-client/client.jsView file

Lines 1-1javascript

1module.exports = { ...require('.') }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prisma-client/client.jsView on unpkg · L1

dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.nodeView file

•path = dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.node kind = native_binary sizeBytes = 21192400 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/prisma-client/libquery_engine-debian-openssl-1.1.x.so.nodeView on unpkg