registry / arkormx / 2.11.3

arkormx@2.11.3

Modern TypeScript-first ORM for Node.js.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 1.39 MB of source

Source & flagged code

3 flagged

dist/relationship-4S2yHPIH.mjsView file

Lines 1-31javascript

1import { Collection } from "@h3ravel/collect.js";

2import { AsyncLocalStorage } from "async_hooks";

3import { createJiti } from "jiti";

4import { pathToFileURL } from "node:url";

5import { dirname, extname, join, resolve } from "node:path";

6import { createRequire } from "module";

7import { existsSync, readdirSync } from "fs";

8import { fileURLToPath } from "url";

9import path from "path";

10import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, writeFileSync as writeFileSync$1 } from "node:fs";

11import { createHash, randomUUID } from "node:crypto";

12import { spawnSync } from "node:child_process";

13import { str } from "@h3ravel/support";

High

Child Process

Package source references child process execution.

dist/relationship-4S2yHPIH.mjsView on unpkg · L11

15//#region src/Exceptions/ArkormException.ts

16var ArkormException = class extends Error {

17 constructor(message, context = {}) {

18 super(message, context.cause === void 0 ? void 0 : { cause: context.cause });

19 this.name = "ArkormException";

20 this.code = context.code;

21 this.operation = context.operation;

22 this.model = context.model;

23 this.delegate = context.delegate;

24 this.relation = context.relation;

25 this.scope = context.scope;

26 this.meta = context.meta;

27 }

28 getContext() {

29 return {

30 code: this.code,

31 operation: this.operation,

Lines 810-850javascript

810//#endregion

811//#region src/Exceptions/UnsupportedAdapterFeatureException.ts

812var UnsupportedAdapterFeatureException = class extends ArkormException {

813 constructor(message, context = {}) {

814 super(message, {

815 code: "UNSUPPORTED_ADAPTER_FEATURE",

816 ...context

Lines 3008-3048javascript

3008* dropping tables.

3009*

3010* @param schema The current Prisma schema string.

3011* @param operations The list of schema operations to apply.

3012* @returns The updated Prisma schema string after applying all operations.

3013*/

3014const applyOperationsToPrismaSchema = (schema, operations) => {

3015 return operations.reduce

Source & flagged code

3 flagged · loading source

dist/relationship-4S2yHPIH.mjsView file

11import { createHash, randomUUID } from "node:crypto"; L12: import { spawnSync } from "node:child_process"; L13: import { str } from "@h3ravel/support";

High

Child Process

Package source references child process execution.

dist/relationship-4S2yHPIH.mjsView on unpkg · L11

3028const runPrismaCommand = (args, cwd) => { L3029: const command = spawnSync("npx", ["prisma", ...args], { L3030: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/relationship-4S2yHPIH.mjsView on unpkg · L3028

830sourceMaps: true L831: }).import(resolvedPath, useDefault ? { default: true } : {}); L832: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/relationship-4S2yHPIH.mjsView on unpkg · L830

Findings

3 High3 Medium3 Low

HighChild Processdist/relationship-4S2yHPIH.mjs

HighShell

HighRuntime Package Installdist/relationship-4S2yHPIH.mjs

MediumDynamic Requiredist/relationship-4S2yHPIH.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/relationship-4S2yHPIH.mjsView file

Lines 1-31javascript

1import { Collection } from "@h3ravel/collect.js";

2import { AsyncLocalStorage } from "async_hooks";

3import { createJiti } from "jiti";

4import { pathToFileURL } from "node:url";

5import { dirname, extname, join, resolve } from "node:path";

6import { createRequire } from "module";

7import { existsSync, readdirSync } from "fs";

8import { fileURLToPath } from "url";

9import path from "path";

10import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, writeFileSync as writeFileSync$1 } from "node:fs";

11import { createHash, randomUUID } from "node:crypto";

12import { spawnSync } from "node:child_process";

13import { str } from "@h3ravel/support";

High

Child Process

Package source references child process execution.

dist/relationship-4S2yHPIH.mjsView on unpkg · L11

15//#region src/Exceptions/ArkormException.ts

16var ArkormException = class extends Error {

17 constructor(message, context = {}) {

18 super(message, context.cause === void 0 ? void 0 : { cause: context.cause });

19 this.name = "ArkormException";

20 this.code = context.code;

21 this.operation = context.operation;

22 this.model = context.model;

23 this.delegate = context.delegate;

24 this.relation = context.relation;

25 this.scope = context.scope;

26 this.meta = context.meta;

27 }

28 getContext() {

29 return {

30 code: this.code,

31 operation: this.operation,

Lines 810-850javascript

810//#endregion

811//#region src/Exceptions/UnsupportedAdapterFeatureException.ts

812var UnsupportedAdapterFeatureException = class extends ArkormException {

813 constructor(message, context = {}) {

814 super(message, {

815 code: "UNSUPPORTED_ADAPTER_FEATURE",

816 ...context

Lines 3008-3048javascript

3008* dropping tables.

3009*

3010* @param schema The current Prisma schema string.

3011* @param operations The list of schema operations to apply.

3012* @returns The updated Prisma schema string after applying all operations.

3013*/

3014const applyOperationsToPrismaSchema = (schema, operations) => {

3015 return operations.reduce