@vertexa/prisma@7.8.6: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@vertexa/prisma@7.8.6: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-entry.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

build/index.jsView file

1#!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must provide pattern");if(typeof r=="function"||arguments.len... L10: See: https://gi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

build/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> build/index.js L1: #!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must provide pattern");if(ty

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

build/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d...

High

Child Process

Package source references child process execution.

build/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must provide pattern");if(typeof r=="function"||arguments.len... L10: See: https://gi

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

build/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must provide pattern");if(typeof r=="function"||arguments.len... L10: See: https://gi

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

build/index.jsView on unpkg · L1

4>>> no match, partial?`,r,g,n,x),g===u))}var E;if(typeof p=="string"?(E=f===p,this.debug("string match",p,f,E)):(E=f.match(p),this.debug("pattern match",p,f,E)),!E)return!1}if(a===... L5: %s`,R,R,E,i);let O=E.type==="*"?J9:E.type==="?"?Z9:"\\"+E.type;a=!0,i=i.slice(0,E.reStart)+O+"\\("+R}D(),c&&(i+="\\\\");let I=Iut[i.charAt(0)];for(let R=l.length-1;R>-1;R--){let O=... L6: `,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

build/index.jsView on unpkg · L4

1Trigger-reachable credential exfiltration chain: manifest.main -> build/index.js L1: #!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

build/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> build/index.js L1: #!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

build/index.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/index.jsView on unpkg

build/query_compiler_fast_bg.mysql.wasmView file

•path = build/query_compiler_fast_bg.mysql.wasm kind = wasm_module sizeBytes = 3510687 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/query_compiler_fast_bg.mysql.wasmView on unpkg

build/child.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = prisma@7.9.0 matchedPath = build/child.js matchedIdentity = npm:cHJpc21h:7.9.0 similarity = 0.923 shingleOverlap = 24 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

build/child.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 106-146json

106 "default": "./config.js"

107 },

108 "./build/index.js": {

109 "require": {

110 "types": "./dist/cli/src/types.d.ts",

111 "default": "./build/index.js"

112 },

113 "default": "./build/index.js"

114 }

115 },

116 "scripts": {

117 "prisma": "tsx src/bin.ts",

118 "platform": "tsx src/bin.ts platform --early-access",

119 "pm": "tsx src/bin.ts platform --early-access",

120 "dev": "DEV=true tsx helpers/build.ts",

121 "build": "tsx helpers/build.ts",

122 "generate-api-client": "openapi-typescript https://api.prisma.io/v1/doc --output ./src/management-api/openapi.d.ts && prettier --write ./src/management-api/openapi.d.ts",

123 "test": "dotenv -e ../../.db.env -- tsx helpers/run-tests.ts",

124 "test:platform": "dotenv -e ../../.db.env -- tsx helpers/run-tests.ts src/platform",

125 "tsc": "tsc -d -p tsconfig.build.json",

126 "preinstall": "node scripts/preinstall-entry.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L126

127 },

128 "dependencies": {

129 "@vertexa/prisma-config": "^7.8.6",

130 "@prisma/dev": "0.24.3",

131 "@vertexa/prisma-engines": "^7.8.6",

132 "@prisma/studio-core": "0.27.3",

133 "mysql2": "3.15.3",

134 "postgres": "3.4.7"

135 },

136 "peerDependencies": {

137 "better-sqlite3": ">=9.0.0",

138 "typescript": ">=5.4.0"

139 },

140 "peerDependenciesMeta": {

141 "better-sqlite3": {

142 "optional": true

143 },

144 "typescript": {

145 "optional": true

146 }

build/index.jsView file

1#!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must provide pattern");if(typeof r=="function"||arguments.len... L10: See: https://gi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

build/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> build/index.js L1: #!/usr/bin/env node L2: "use strict";var Hnt=Object.create;var iO=Object.defineProperty;var Wnt=Object.getOwnPropertyDescriptor;var Vnt=Object.getOwnPropertyNames;var znt=Object.getPrototypeOf,Knt=Object.... L3: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L8: %s`,O,O,I,o);var k=I.type==="*"?PG:I.type==="?"?CG:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+k+"\\("+O}E(),a&&(o+="\\\\");var q=!1;switch(o.charAt(0)){case"[":case".":case"(":q=!0}fo... L9: See: https://github.com/isaacs/node-glob/issues/167`);return new li(e,r).found}function li(e,r){if(!e)throw new Error("must provide pattern");if(ty

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

build/index.jsView on unpkg · L1

build/query_compiler_fast_bg.mysql.wasmView file

•path = build/query_compiler_fast_bg.mysql.wasm kind = wasm_module sizeBytes = 3510687 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/query_compiler_fast_bg.mysql.wasmView on unpkg

build/child.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = prisma@7.9.0 matchedPath = build/child.js matchedIdentity = npm:cHJpc21h:7.9.0 similarity = 0.923 shingleOverlap = 24 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

build/child.jsView on unpkg