registry / awaitly-postgres / 36.0.0

awaitly-postgres@36.0.0

PostgreSQL persistence adapter for awaitly workflows

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The static finding is explained by the legitimate runtime bridge to pg and awaitly/durable. There are no lifecycle hooks or indicators of unconsented execution, exfiltration, persistence, or remote payload loading.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller invokes postgres with a database URL and uses its store methods.

Impact

It can create and modify tables in the caller-selected PostgreSQL database.

Mechanism

Caller-directed PostgreSQL snapshot storage.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no install lifecycle hook and exposes only build, test, lint, and clean scripts.
The CommonJS entry point only loads pg, awaitly/durable, and crypto.
Database access is initiated through the exported postgres function with a caller-supplied connection URL.

Evidence against

The package can create tables and modify snapshot rows in the PostgreSQL database selected by its caller.
No credential harvesting, filesystem access, shell execution, remote endpoint, or dynamic code execution was found.

Behavioral surface

Source

Crypto

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.27 KB of source

Source & flagged code

4 flagged

dist/index.cjsView file

Lines 1-29javascript

1"use strict";var S=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var L=Object.prototype.hasOwnProperty;var I=(o,t)=>{for(var e in t)S(o,e,{get:t[e],enumerable:!0})},N=(o,t,e,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let l of _(t))!L.call(o,l)&&l!==e&&S(o,l,{get:()=>t[l],enumerable:!(s=k(t,l))||s.enumerable});return o};var R=o=>N(S({},"__esModule",{value:!0}),o);var $={};I($,{postgres:()=>O});module.exports=R($);var y=require("pg"),c=require("awaitly/durable");var g=require("crypto");function E(o,t,e){let s,l=async()=>{let n=await o.c ...

Low

Ai Review Evidence

The CommonJS entry point only loads pg, awaitly/durable, and crypto.

dist/index.cjsView on unpkg · L1

2 CREATE TABLE IF NOT EXISTS ${e} (

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L1

3 workflow_id TEXT PRIMARY KEY,

4 owner_token TEXT NOT NULL,

5 expires_at TIMESTAMPTZ NOT NULL

6 );

7 CREATE INDEX IF NOT EXISTS ${s} ON ${e}(expires_at);

8 `);async function n(d,a){let w=a?.ttlMs??6e4,r=(0,g.randomUUID)(),i=new Date(Date.now()+w);await l();let p=await o.query(`

9 INSERT INTO ${e} (workflow_id, owner_token, expires_at)

10 VALUES ($1, $2, $3)

11 ON CONFLICT (workflow_id) DO UPDATE SET

12 owner_token = EXCLUDED.owner_token,

13 expires_at = EXCLUDED.expires_at

14 WHERE ${e}.expires_at < NOW()

15 RETURNING owner_token

16 `,[d,r,i]);return p.rowCount===1&&p.rows[0].owner_token===r?{ownerToken:r}:null}async function u(d,a){await o.query(`DELETE FROM ${e} WHERE workflow_id = $1 AND owner_token = $2`,[d,a])}async function T(d,a,w){let r=w?.ttlMs??6e4,i=new Date(Date.now()+r);return((await o.query(`UPDATE ${e} SET expires_at = $1 WHERE workflow_id = $2 AND owner_token = $3`,[i,d,a])).rowCount??0)>0}return{tryAcquire:n,release:u,renew:T,ensureLockTable:l}}var A=/^[a-zA-Z_][a-zA-Z0-9_]*$/;function O(o){let t=typeof o=="string"?{url:o}:o,e=t.table??"awaitly_snapshots";if(!A.test(e))throw new Error(`

17 CREATE TABLE IF NOT EXISTS ${e} (

18 id TEXT PRIMARY KEY,

19 snapshot JSONB NOT NULL,

20 updated_at TIMESTAMPTZ DEFAULT NOW()

21 );

22 CREATE INDEX IF NOT EXISTS ${e}_updated_at_idx ON ${e} (updated_at DESC);

23 `),d=()=>l?T():Promise.resolve(),a=t.lock?P(u,t.lock):null,w={async save(r,i){await d();let p=s+r,m=(0,c.isResumeState)(i)?(0,c.serializeResumeState)(i):i;await u.query(`INSERT INTO ${e} (id, snapshot, updated_at)

24 VALUES ($1, $2, NOW())

25 ON CONFLICT (id) DO UPDATE SET snapshot = $2, updated_at = NOW()`,[p,JSON.stringify(m)])},async load(r){await d();let i=s+r,p=await u.query(`SELECT snapshot FROM ${e} WHERE id = $1`,[i]);if(p.rows.length===0)return null;let m=p.rows[0].snapshot;return(0,c.isSerializedResumeState)(m)?(0,c.deserializeResumeState)(m):((0,c.isWorkflowSnapshot)(m),m)},async loadResumeState(r){let i=await w.load(r);return i===null?null:(0,c.isResumeState)(i)?i:null},async delete(r){await d();let i=s+r;await u.query(`DELETE FROM

26 WHERE id LIKE $1

27 ORDER BY updated_at DESC

28 LIMIT $2`,[i+"%",p])).rows.map(f=>({id:f.id.slice(s.length),updatedAt:f.updated_at.toISOString()}))},async close(){n&&await u.end()}};return a&&(w.tryAcquire=a.tryAcquire.bind(a),w.release=a.release.bind(a),w.renew=a.renew.bind(a)),w}0&&

29//# sourceMappingURL=index.cjs.map

Long lines were clipped for display.

package.jsonView file

Lines 43-72json

43 "dependencies": {

44 "@types/pg": "8.20.4",

45 "pg": "8.22.0"

46 },

47 "devDependencies": {

48 "@total-typescript/ts-reset": "0.6.1",

Source & flagged code

4 flagged · loading source

dist/index.cjsView file

1package = awaitly-postgres; repositoryIdentity = awaitly; dependency = pg L1: "use strict";var S=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var L=Object.prototype.hasOwnProperty;var I=(o,t)=>{for(var e in t)S... L2: CREATE TABLE IF NOT EXISTS ${e} (

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L1

1var y=require("pg"),c=require("awaitly/durable");var g=require("crypto");

Low

Ai Review Evidence

The CommonJS entry point only loads pg, awaitly/durable, and crypto.

dist/index.cjsView on unpkg · L1

16function O(o){let t=typeof o=="string"?{url:o}:o,e=t.table??"awaitly_snapshots";

Low

Ai Review Evidence

Database access is initiated through the exported postgres function with a caller-supplied connection URL.

dist/index.cjsView on unpkg · L16

Findings

1 High1 Medium5 Low

HighCopied Package Dependency Bridgedist/index.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.cjs

Affected versions and remediation

This report applies to awaitly-postgres@36.0.0.

See all versions of awaitly-postgres for other recorded verdicts.

Review the evidence and your use of awaitly-postgres@36.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 09:28:17.760Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.