registry / arkormx / 2.11.1

arkormx@2.11.1

Modern TypeScript-first ORM for Node.js.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 1.37 MB of source

Source & flagged code

3 flagged

dist/relationship-CP1xbMOa.mjsView file

Lines 1-31javascript

1import { Collection } from "@h3ravel/collect.js";

2import { AsyncLocalStorage } from "async_hooks";

3import { createJiti } from "jiti";

4import { pathToFileURL } from "node:url";

5import { dirname, extname, join, resolve } from "node:path";

6import { createRequire } from "module";

7import { existsSync, readdirSync } from "fs";

8import { fileURLToPath } from "url";

9import path from "path";

10import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, writeFileSync as writeFileSync$1 } from "node:fs";

11import { createHash, randomUUID } from "node:crypto";

12import { spawnSync } from "node:child_process";

13import { str } from "@h3ravel/support";

High

Child Process

Package source references child process execution.

dist/relationship-CP1xbMOa.mjsView on unpkg · L11

15//#region src/Exceptions/ArkormException.ts

16var ArkormException = class extends Error {

17 constructor(message, context = {}) {

18 super(message, context.cause === void 0 ? void 0 : { cause: context.cause });

19 this.name = "ArkormException";

20 this.code = context.code;

21 this.operation = context.operation;

22 this.model = context.model;

23 this.delegate = context.delegate;

24 this.relation = context.relation;

25 this.scope = context.scope;

26 this.meta = context.meta;

27 }

28 getContext() {

29 return {

30 code: this.code,

31 operation: this.operation,

Lines 810-850javascript

810//#endregion

811//#region src/Exceptions/UnsupportedAdapterFeatureException.ts

812var UnsupportedAdapterFeatureException = class extends ArkormException {

813 constructor(message, context = {}) {

814 super(message, {

815 code: "UNSUPPORTED_ADAPTER_FEATURE",

816 ...context

Lines 2965-3005javascript

2965* dropping tables.

2966*

2967* @param schema The current Prisma schema string.

2968* @param operations The list of schema operations to apply.

2969* @returns The updated Prisma schema string after applying all operations.

2970*/

2971const applyOperationsToPrismaSchema = (schema, operations) => {

2972 return operations.reduce

Source & flagged code

3 flagged · loading source

dist/relationship-CP1xbMOa.mjsView file

11import { createHash, randomUUID } from "node:crypto"; L12: import { spawnSync } from "node:child_process"; L13: import { str } from "@h3ravel/support";

High

Child Process

Package source references child process execution.

dist/relationship-CP1xbMOa.mjsView on unpkg · L11

2985const runPrismaCommand = (args, cwd) => { L2986: const command = spawnSync("npx", ["prisma", ...args], { L2987: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/relationship-CP1xbMOa.mjsView on unpkg · L2985

830sourceMaps: true L831: }).import(resolvedPath, useDefault ? { default: true } : {}); L832: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/relationship-CP1xbMOa.mjsView on unpkg · L830

Findings

3 High3 Medium3 Low

HighChild Processdist/relationship-CP1xbMOa.mjs

HighShell

HighRuntime Package Installdist/relationship-CP1xbMOa.mjs

MediumDynamic Requiredist/relationship-CP1xbMOa.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/relationship-CP1xbMOa.mjsView file

Lines 1-31javascript

1import { Collection } from "@h3ravel/collect.js";

2import { AsyncLocalStorage } from "async_hooks";

3import { createJiti } from "jiti";

4import { pathToFileURL } from "node:url";

5import { dirname, extname, join, resolve } from "node:path";

6import { createRequire } from "module";

7import { existsSync, readdirSync } from "fs";

8import { fileURLToPath } from "url";

9import path from "path";

10import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, writeFileSync as writeFileSync$1 } from "node:fs";

11import { createHash, randomUUID } from "node:crypto";

12import { spawnSync } from "node:child_process";

13import { str } from "@h3ravel/support";

High

Child Process

Package source references child process execution.

dist/relationship-CP1xbMOa.mjsView on unpkg · L11

15//#region src/Exceptions/ArkormException.ts

16var ArkormException = class extends Error {

17 constructor(message, context = {}) {

18 super(message, context.cause === void 0 ? void 0 : { cause: context.cause });

19 this.name = "ArkormException";

20 this.code = context.code;

21 this.operation = context.operation;

22 this.model = context.model;

23 this.delegate = context.delegate;

24 this.relation = context.relation;

25 this.scope = context.scope;

26 this.meta = context.meta;

27 }

28 getContext() {

29 return {

30 code: this.code,

31 operation: this.operation,

Lines 810-850javascript

810//#endregion

811//#region src/Exceptions/UnsupportedAdapterFeatureException.ts

812var UnsupportedAdapterFeatureException = class extends ArkormException {

813 constructor(message, context = {}) {

814 super(message, {

815 code: "UNSUPPORTED_ADAPTER_FEATURE",

816 ...context

Lines 2965-3005javascript

2965* dropping tables.

2966*

2967* @param schema The current Prisma schema string.

2968* @param operations The list of schema operations to apply.

2969* @returns The updated Prisma schema string after applying all operations.

2970*/

2971const applyOperationsToPrismaSchema = (schema, operations) => {

2972 return operations.reduce