autotel-drizzle@0.2.2

OpenTelemetry instrumentation for Drizzle ORM

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 3 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVars

Supply chain

Minified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 50.4 KB of source

Source & flagged code

1 flagged

dist/drizzle-BPYatG7J.jsView file

Lines 97-137javascript

97 rowsRemovedByIndexRecheck: toCount(raw["Rows Removed by Index Recheck"]),

98 sharedHitBlocks: toCount(raw["Shared Hit Blocks"]),

99 sharedReadBlocks: toCount(raw["Shared Read Blocks"]),

100 isLeaf: !Array.isArray(children)

101 };

102}

103function* flattenPlan(node) {

104 if (!isDriverObject(node)) return;

105 yield decodePlanNode(node);

106 const children = node.Plans;

107 if (Array.isArray(children)) for (const child of children) yield* flattenPlan(child);

108}

109function parseExplainResponse(result) {

110 const response = asDriverObject(result);

111 const rows = response === void 0 ? result : response.rows;

112 if (!Array.isArray(rows) || rows.length === 0) return;

113 const firstRow = rows[0];

114 if (!isDriverObject(firstRow)) return;

115 const column = Object.values(firstRow)[0];

116 let decoded;

117 try {

118 decoded = typeof column === "string" ? JSON.parse(column) : column;

119 } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/drizzle-BPYatG7J.jsView on unpkg · L117

120 return;

121 }

122 const envelope = Array.isArray(decoded) ? decoded[0] : decoded;

123 if (!isDriverObject(envelope)) return;

124 const nodes = [...flattenPlan(envelope.Plan)];

125 if (nodes.length === 0) return;

126 return {

127 nodes,

128 executionMs: toOptionalNumber(envelope["Execution Time"])

129 };

130}

131//#endregion

132//#region src/drizzle/index.ts

133const SEMATTRS_DB_PLAN_NODE = "db.plan.node";

134const SEMATTRS_DB_PLAN_INDEXES = "db.plan.indexes";

135const SEMATTRS_DB_PLAN_COST = "db.plan.cost";

136const SEMATTRS_DB_PLAN_ROWS_ESTIMATED = "db.plan.rows_estimated";

137const SEMATTRS_DB_PLAN_ROWS_EXAMINED = "db.plan.rows_examined";

Source & flagged code

1 flagged · loading source

dist/drizzle-BPYatG7J.jsView file

117try { L118: decoded = typeof column === "string" ? JSON.parse(column) : column; L119: } catch { ... L155: function semconvFromEnvironment() { L156: const optIn = process.env.OTEL_SEMCONV_STABILITY_OPT_IN; L157: if (!optIn) return "legacy";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/drizzle-BPYatG7J.jsView on unpkg · L117

Findings

1 Medium2 Low

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/drizzle-BPYatG7J.js

Affected versions and remediation

This report applies to autotel-drizzle@0.2.2.

See all versions of autotel-drizzle for other recorded verdicts.

Review the evidence and your use of autotel-drizzle@0.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 23:37:44.396Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.