registry / awaitly-postgres / 35.0.0

awaitly-postgres@35.0.0

PostgreSQL persistence adapter for awaitly workflows

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Direct inspection shows a compact PostgreSQL adapter with no lifecycle execution or hostile primitives. The scanner's dependency-bridge signal is explained by declared pg and awaitly dependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the module and calls postgres() with a database URL or pool.

Impact

It can create and modify its configured PostgreSQL tables, as expected for a persistence adapter.

Mechanism

Caller-directed PostgreSQL snapshot persistence and optional table creation.

AI rationale

Direct inspection shows a compact PostgreSQL adapter with no lifecycle execution or hostile primitives. The scanner's dependency-bridge signal is explained by declared pg and awaitly dependencies.

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The published entrypoint imports pg and awaitly/durable, consistent with a PostgreSQL workflow adapter.
The manifest declares only normal development scripts and no install lifecycle hook.

Evidence against

No child-process, shell, eval, filesystem-harvesting, or HTTP client behavior appears in the published entrypoints.
Database connections and schema creation occur only after the caller invokes postgres().
The code performs parameterized PostgreSQL snapshot and lock operations; no external network endpoint is embedded.

Behavioral surface

Source

Crypto

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.27 KB of source

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 1-21javascript

1"use strict";var S=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var L=Object.prototype.hasOwnProperty;var I=(o,t)=>{for(var e in t)S(o,e,{get:t[e],enumerable:!0})},N=(o,t,e,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let l of _(t))!L.call(o,l)&&l!==e&&S(o,l,{get:()=>t[l],enumerable:!(s=k(t,l))||s.enumerable});return o};var R=o=>N(S({},"__esModule",{value:!0}),o);var $={};I($,{postgres:()=>O});module.exports=R($);var y=require("pg"),c=require("awaitly/durable");var g=require("crypto");function E(o,t,e){let s,l=async()=>{let n=await o.c ...

Low

Ai Review Evidence

The published entrypoint imports pg and awaitly/durable, consistent with a PostgreSQL workflow adapter.

dist/index.cjsView on unpkg · L1

2 CREATE TABLE IF NOT EXISTS ${e} (

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L1

3 workflow_id TEXT PRIMARY KEY,

4 owner_token TEXT NOT NULL,

5 expires_at TIMESTAMPTZ NOT NULL

6 );

7 CREATE INDEX IF NOT EXISTS ${s} ON ${e}(expires_at);

8 `);async function n(d,a){let w=a?.ttlMs??6e4,r=(0,g.randomUUID)(),i=new Date(Date.now()+w);await l();let p=await o.query(`

9 INSERT INTO ${e} (workflow_id, owner_token, expires_at)

10 VALUES ($1, $2, $3)

11 ON CONFLICT (workflow_id) DO UPDATE SET

12 owner_token = EXCLUDED.owner_token,

13 expires_at = EXCLUDED.expires_at

14 WHERE ${e}.expires_at < NOW()

15 RETURNING owner_token

16 `,[d,r,i]);return p.rowCount===1&&p.rows[0].owner_token===r?{ownerToken:r}:null}async function u(d,a){await o.query(`DELETE FROM ${e} WHERE workflow_id = $1 AND owner_token = $2`,[d,a])}async function T(d,a,w){let r=w?.ttlMs??6e4,i=new Date(Date.now()+r);return((await o.query(`UPDATE ${e} SET expires_at = $1 WHERE workflow_id = $2 AND owner_token = $3`,[i,d,a])).rowCount??0)>0}return{tryAcquire:n,release:u,renew:T,ensureLockTable:l}}var A=/^[a-zA-Z_][a-zA-Z0-9_]*$/;function O(o){let t=typeof o=="string"?{url:o}:o,e=t.table??"awaitly_snapshots";if(!A.test(e))throw new Error(`

17 CREATE TABLE IF NOT EXISTS ${e} (

18 id TEXT PRIMARY KEY,

19 snapshot JSONB NOT NULL,

20 updated_at TIMESTAMPTZ DEFAULT NOW()

21 );

Long lines were clipped for display.

package.jsonView file

Lines 43-72json

43 "dependencies": {

44 "@types/pg": "8.20.4",

45 "pg": "8.22.0"

46 },

47 "devDependencies": {

48 "@total-typescript/ts-reset": "0.6.1",

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

1package = awaitly-postgres; repositoryIdentity = awaitly; dependency = pg L1: "use strict";var S=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var L=Object.prototype.hasOwnProperty;var I=(o,t)=>{for(var e in t)S... L2: CREATE TABLE IF NOT EXISTS ${e} (

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L1

1var y=require("pg"),c=require("awaitly/durable");var g=require("crypto");

Low

Ai Review Evidence

The published entrypoint imports pg and awaitly/durable, consistent with a PostgreSQL workflow adapter.

dist/index.cjsView on unpkg · L1

package.jsonView file

63"scripts": { "build": "tsup", "type-check": "tsc --noEmit", "test": "vitest run", "test:watch": "vitest watch", "lint": "eslint .", "clean": "rm -rf dist", "quality": "pnpm type-check && pnpm test && pnpm lint" }

Findings

1 High1 Medium4 Low

HighCopied Package Dependency Bridgedist/index.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowAi Review Evidencedist/index.cjs

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to awaitly-postgres@35.0.0.

See all versions of awaitly-postgres for other recorded verdicts.

Review the evidence and your use of awaitly-postgres@35.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 13:20:21.205Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.