autotel-drizzle@0.2.6

OpenTelemetry instrumentation for Drizzle ORM

Static Scan Results

scanned 26d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 4 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVars

Supply chain

Minified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 50.5 KB of source

Source & flagged code

2 flagged

dist/drizzle-BiA8DdAa.jsView file

Lines 97-137javascript

97 rowsRemovedByIndexRecheck: toCount(raw["Rows Removed by Index Recheck"]),

98 sharedHitBlocks: toCount(raw["Shared Hit Blocks"]),

99 sharedReadBlocks: toCount(raw["Shared Read Blocks"]),

100 isLeaf: !Array.isArray(children)

101 };

102}

103function* flattenPlan(node) {

104 if (!isDriverObject(node)) return;

105 yield decodePlanNode(node);

106 const children = node.Plans;

107 if (Array.isArray(children)) for (const child of children) yield* flattenPlan(child);

108}

109function parseExplainResponse(result) {

110 const response = asDriverObject(result);

111 const rows = response === void 0 ? result : response.rows;

112 if (!Array.isArray(rows) || rows.length === 0) return;

113 const firstRow = rows[0];

114 if (!isDriverObject(firstRow)) return;

115 const column = Object.values(firstRow)[0];

116 let decoded;

117 try {

118 decoded = typeof column === "string" ? JSON.parse(column) : column;

119 } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/drizzle-BiA8DdAa.jsView on unpkg · L117

120 return;

121 }

122 const envelope = Array.isArray(decoded) ? decoded[0] : decoded;

123 if (!isDriverObject(envelope)) return;

124 const nodes = [...flattenPlan(envelope.Plan)];

125 if (nodes.length === 0) return;

126 return {

127 nodes,

128 executionMs: toOptionalNumber(envelope["Execution Time"])

129 };

130}

131//#endregion

132//#region src/drizzle/index.ts

133const SEMATTRS_DB_PLAN_NODE = "db.plan.node";

134const SEMATTRS_DB_PLAN_INDEXES = "db.plan.indexes";

135const SEMATTRS_DB_PLAN_COST = "db.plan.cost";

136const SEMATTRS_DB_PLAN_ROWS_ESTIMATED = "db.plan.rows_estimated";

137const SEMATTRS_DB_PLAN_ROWS_EXAMINED = "db.plan.rows_examined";

dist/drizzle-BK9eu10E.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-drizzle@0.2.4 matchedIdentity = npm:YXV0b3RlbC1kcml6emxl:0.2.4 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/drizzle-BK9eu10E.cjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/drizzle-BiA8DdAa.jsView file

117try { L118: decoded = typeof column === "string" ? JSON.parse(column) : column; L119: } catch { ... L155: function semconvFromEnvironment() { L156: const optIn = process.env.OTEL_SEMCONV_STABILITY_OPT_IN; L157: if (!optIn) return "legacy";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/drizzle-BiA8DdAa.jsView on unpkg · L117

dist/drizzle-BK9eu10E.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/drizzle-BK9eu10E.cjsView on unpkg

Findings

1 High1 Medium2 Low

HighPrevious Version Dangerous Deltadist/drizzle-BK9eu10E.cjs

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/drizzle-BiA8DdAa.js

Affected versions and remediation

This report applies to autotel-drizzle@0.2.6.

See all versions of autotel-drizzle for other recorded verdicts.

Review the evidence and your use of autotel-drizzle@0.2.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 23:26:32.774Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.