@vertexa/prisma@7.9.1: Malicious npm security report (Block)

Loading npm security reports…

Source & flagged code

15 flagged

package.jsonView file

Lines 106-146json

106 "default": "./config.js"

107 },

108 "./build/index.js": {

109 "require": {

110 "types": "./dist/cli/src/types.d.ts",

111 "default": "./build/index.js"

112 },

113 "default": "./build/index.js"

114 }

115 },

116 "scripts": {

117 "prisma": "tsx src/bin.ts",

118 "platform": "tsx src/bin.ts platform --early-access",

119 "pm": "tsx src/bin.ts platform --early-access",

120 "dev": "DEV=true tsx helpers/build.ts",

121 "build": "tsx helpers/build.ts",

122 "generate-api-client": "openapi-typescript https://api.prisma.io/v1/doc --output ./src/management-api/openapi.d.ts && prettier --write ./src/management-api/openapi.d.ts",

123 "test": "dotenv -e ../../.db.env -- tsx helpers/run-tests.ts",

124 "test:platform": "dotenv -e ../../.db.env -- tsx helpers/run-tests.ts src/platform",

125 "tsc": "tsc -d -p tsconfig.build.json",

126 "preinstall": "node scripts/preinstall-entry.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L126

127 },

128 "dependencies": {

129 "@vertexa/prisma-config": "^7.9.1",

130 "@prisma/dev": "0.24.17",

131 "@vertexa/prisma-engines": "^7.9.1",

132 "@prisma/studio-core": "0.33.0",

133 "mysql2": "3.15.3",

134 "postgres": "3.4.7"

135 },

136 "peerDependencies": {

137 "better-sqlite3": ">=9.0.0",

138 "typescript": ">=5.4.0"

139 },

140 "peerDependenciesMeta": {

141 "better-sqlite3": {

142 "optional": true

143 },

144 "typescript": {

145 "optional": true

146 }

build/studio.jsView file

135L136: `)}function VIr(t){let{analysis:r}=t;return(0,St.jsxs)("div",{className:"flex flex-col gap-3 text-sm",children:[(0,St.jsx)("p",{className:"text-muted-foreground",children:r.summary... L137: `){[r,i]=uW(this,r,i);let l="";for(let c=0,d=0;c<=i&&d<this.text.length;d++){let p=this.text[d],w=c+p.length;c>r&&d&&(l+=s),r<w&&i>c&&(l+=p.slice(Math.max(0,r-c),i-c)),c=w+1}return...

High

Child Process

Package source references child process execution.

build/studio.jsView on unpkg · L135

build/cli.jsView file

1"use strict";var Ast=Object.create;var LO=Object.defineProperty;var Pst=Object.getOwnPropertyDescriptor;var Ist=Object.getOwnPropertyNames;var Ost=Object.getPrototypeOf,Rst=Object.... L2: globstar while`,r,g,n,x,b),this.matchOne(r.slice(g),n.slice(x),o))return this.debug("globstar found match!",g,u,b),!0;if(b==="."||b===".."||!i.dot&&b.charAt(0)==="."){this.debug("d... ... L7: %s`,A,A,I,o);var $=I.type==="*"?_H:I.type==="?"?wH:"\\"+I.type;i=!0,o=o.slice(0,I.reStart)+$+"\\("+A}v(),a&&(o+="\\\\");var j=!1;switch(o.charAt(0)){case"[":case".":case"(":j=!0}fo... L8: See: https://github.com/isaacs/node-glob/issues/167`);return new yi(e,r).found}function yi(e,r){if(!e)throw new Error("must provide pattern");if(typeof r=="function"||arguments.len... L9: See: https://github.com/isaacs/node-glob

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

build/cli.jsView on unpkg · L1

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

build/cli.jsView on unpkg · L1

build/query_compiler_fast_bg.mysql.wasmView file

•path = build/query_compiler_fast_bg.mysql.wasm kind = wasm_module sizeBytes = 3510687 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/query_compiler_fast_bg.mysql.wasmView on unpkg

build/child.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = prisma@7.9.0 matchedPath = build/child.js matchedIdentity = npm:cHJpc21h:7.9.0 similarity = 0.964 shingleOverlap = 27 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

build/child.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-entry.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

build/studio.jsView file

High

Child Process

Package source references child process execution.

build/studio.jsView on unpkg · L135

build/cli.jsView file

@vertexa/prisma@7.9.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged

package.jsonView file

Lines 106-146json

106 "default": "./config.js"

107 },

108 "./build/index.js": {

109 "require": {

110 "types": "./dist/cli/src/types.d.ts",

111 "default": "./build/index.js"

112 },

113 "default": "./build/index.js"

114 }

115 },

116 "scripts": {

117 "prisma": "tsx src/bin.ts",

118 "platform": "tsx src/bin.ts platform --early-access",

119 "pm": "tsx src/bin.ts platform --early-access",

120 "dev": "DEV=true tsx helpers/build.ts",

121 "build": "tsx helpers/build.ts",

122 "generate-api-client": "openapi-typescript https://api.prisma.io/v1/doc --output ./src/management-api/openapi.d.ts && prettier --write ./src/management-api/openapi.d.ts",

123 "test": "dotenv -e ../../.db.env -- tsx helpers/run-tests.ts",

124 "test:platform": "dotenv -e ../../.db.env -- tsx helpers/run-tests.ts src/platform",

125 "tsc": "tsc -d -p tsconfig.build.json",

126 "preinstall": "node scripts/preinstall-entry.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L126

127 },

128 "dependencies": {

129 "@vertexa/prisma-config": "^7.9.1",

130 "@prisma/dev": "0.24.17",

131 "@vertexa/prisma-engines": "^7.9.1",

132 "@prisma/studio-core": "0.33.0",

133 "mysql2": "3.15.3",

134 "postgres": "3.4.7"

135 },

136 "peerDependencies": {

137 "better-sqlite3": ">=9.0.0",

138 "typescript": ">=5.4.0"

139 },

140 "peerDependenciesMeta": {

141 "better-sqlite3": {

142 "optional": true

143 },

144 "typescript": {

145 "optional": true

146 }

build/studio.jsView file

High

Child Process

Package source references child process execution.

build/studio.jsView on unpkg · L135

build/cli.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

build/cli.jsView on unpkg · L1

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

build/cli.jsView on unpkg · L1

build/query_compiler_fast_bg.mysql.wasmView file

•path = build/query_compiler_fast_bg.mysql.wasm kind = wasm_module sizeBytes = 3510687 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/query_compiler_fast_bg.mysql.wasmView on unpkg

build/child.jsView file

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

build/child.jsView on unpkg

@vertexa/prisma@7.9.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code