registry / arkormx / 2.11.4

arkormx@2.11.4

Modern TypeScript-first ORM for Node.js.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 1.40 MB of source

Source & flagged code

3 flagged

dist/relationship-Bds4OCOY.cjsView file

Lines 7-60javascript

7var __hasOwnProp = Object.prototype.hasOwnProperty;

8var __copyProps = (to, from, except, desc) => {

9 if (from && typeof from === "object" || typeof from === "function") {

10 for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

11 key = keys[i];

12 if (!__hasOwnProp.call(to, key) && key !== except) {

13 __defProp(to, key, {

14 get: ((k) => from[k]).bind(null, key),

15 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

16 });

17 }

18 }

19 }

20 return to;

21};

22var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

23 value: mod,

24 enumerable: true

25}) : target, mod));

27//#endregion

28let _h3ravel_collect_js = require("@h3ravel/collect.js");

29let async_hooks = require("async_hooks");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/relationship-Bds4OCOY.cjsView on unpkg · L27

30let jiti = require("jiti");

31let node_url = require("node:url");

32let node_path = require("node:path");

33let module$1 = require("module");

34let fs = require("fs");

35let url = require("url");

36let path = require("path");

37path = __toESM(path, 1);

38let node_fs = require("node:fs");

39let node_crypto = require("node:crypto");

40let node_async_hooks = require("node:async_hooks");

41let node_child_process = require("node:child_process");

42let _h3ravel_support = require("@h3ravel/support");

High

Child Process

Package source references child process execution.

dist/relationship-Bds4OCOY.cjsView on unpkg · L40

44//#region src/Exceptions/ArkormException.ts

45var ArkormException = class extends Error {

46 constructor(message, context = {}) {

47 super(message, context.cause === void 0 ? void 0 : { cause: context.cause });

48 this.name = "ArkormException";

49 this.code = context.code;

50 this.operation = context.operation;

51 this.model = context.model;

52 this.delegate = context.delegate;

53 this.relation = context.relation;

54 this.scope = context.scope;

55 this.meta = context.meta;

56 }

57 getContext() {

58 return {

59 code: this.code,

60 operation: this.operation,

Lines 3065-3105javascript

3065* dropping tables.

3066*

3067* @param schema The current Prisma schema string.

3068* @param operations The list of schema operations to apply.

3069* @returns The updated Prisma schema string after applying all operations.

3070*/

3071const applyOperationsToPrismaSchema = (schema, operations) => {

3072 return operations.reduce

Source & flagged code

3 flagged · loading source

dist/relationship-Bds4OCOY.cjsView file

40let node_async_hooks = require("node:async_hooks"); L41: let node_child_process = require("node:child_process"); L42: let _h3ravel_support = require("@h3ravel/support");

High

Child Process

Package source references child process execution.

dist/relationship-Bds4OCOY.cjsView on unpkg · L40

3085const runPrismaCommand = (args, cwd) => { L3086: const command = (0, node_child_process.spawnSync)("npx", ["prisma", ...args], { L3087: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/relationship-Bds4OCOY.cjsView on unpkg · L3085

27//#endregion L28: let _h3ravel_collect_js = require("@h3ravel/collect.js"); L29: let async_hooks = require("async_hooks");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/relationship-Bds4OCOY.cjsView on unpkg · L27

Findings

3 High3 Medium3 Low

HighChild Processdist/relationship-Bds4OCOY.cjs

HighShell

HighRuntime Package Installdist/relationship-Bds4OCOY.cjs

MediumDynamic Requiredist/relationship-Bds4OCOY.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/relationship-Bds4OCOY.cjsView file

Lines 7-60javascript

7var __hasOwnProp = Object.prototype.hasOwnProperty;

8var __copyProps = (to, from, except, desc) => {

9 if (from && typeof from === "object" || typeof from === "function") {

10 for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

11 key = keys[i];

12 if (!__hasOwnProp.call(to, key) && key !== except) {

13 __defProp(to, key, {

14 get: ((k) => from[k]).bind(null, key),

15 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

16 });

17 }

18 }

19 }

20 return to;

21};

22var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

23 value: mod,

24 enumerable: true

25}) : target, mod));

27//#endregion

28let _h3ravel_collect_js = require("@h3ravel/collect.js");

29let async_hooks = require("async_hooks");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/relationship-Bds4OCOY.cjsView on unpkg · L27

30let jiti = require("jiti");

31let node_url = require("node:url");

32let node_path = require("node:path");

33let module$1 = require("module");

34let fs = require("fs");

35let url = require("url");

36let path = require("path");

37path = __toESM(path, 1);

38let node_fs = require("node:fs");

39let node_crypto = require("node:crypto");

40let node_async_hooks = require("node:async_hooks");

41let node_child_process = require("node:child_process");

42let _h3ravel_support = require("@h3ravel/support");

High

Child Process

Package source references child process execution.

dist/relationship-Bds4OCOY.cjsView on unpkg · L40

44//#region src/Exceptions/ArkormException.ts

45var ArkormException = class extends Error {

46 constructor(message, context = {}) {

47 super(message, context.cause === void 0 ? void 0 : { cause: context.cause });

48 this.name = "ArkormException";

49 this.code = context.code;

50 this.operation = context.operation;

51 this.model = context.model;

52 this.delegate = context.delegate;

53 this.relation = context.relation;

54 this.scope = context.scope;

55 this.meta = context.meta;

56 }

57 getContext() {

58 return {

59 code: this.code,

60 operation: this.operation,

Lines 3065-3105javascript

3065* dropping tables.

3066*

3067* @param schema The current Prisma schema string.

3068* @param operations The list of schema operations to apply.

3069* @returns The updated Prisma schema string after applying all operations.

3070*/

3071const applyOperationsToPrismaSchema = (schema, operations) => {

3072 return operations.reduce