crescodb@0.1.0
Upgrade to crescodb@latest — versions below 1.0.0 are no longer supported and will be refused by the platform.
Instant local backend — SQLite + auto REST API + AI schema generation
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows package-aligned CLI/server functionality with local AI agent capabilities, but no lifecycle execution, stealth persistence, broad agent control hijack, or credential exfiltration. Because the agent can write project files and request shell execution, warn as dangerous dual-use rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs cresco dev and uses the local AI agent/dashboard features.
Impact
Dangerous dual-use local development capability if a user authorizes agent actions, but no unconsented package attack behavior was identified.
Mechanism
localhost AI agent tools with project-scoped file/SQL access and approval-gated shell execution
AI rationale
Static inspection shows package-aligned CLI/server functionality with local AI agent capabilities, but no lifecycle execution, stealth persistence, broad agent control hijack, or credential exfiltration. Because the agent can write project files and request shell execution, warn as dangerous dual-use rather than block.
Evidence
package.jsonbin/cresco.jssrc/server/dev-server.jssrc/core/agent-exec.jssrc/core/agent-fs.jssrc/ai/agent.jssrc/ai/provider.jssrc/cli/account.js~/.cresco/config.jsonproject files under cwdconfig.jsoncresco.dbbackups/cresco-*.db
Network endpoints5
localhost:4000localhost:4000/ai/openai/v1localhost:4000/ai/anthropiclocalhost:4000/cli/melocalhost:4000/backups
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- src/ai/agent.js defines AI tools for project file read/write, SQL, and shell command requests.
- src/server/dev-server.js exposes /_ai endpoints that can write project files and run approved commands.
- src/core/agent-exec.js runs shell commands via /bin/sh or PowerShell when approved.
- src/ai/provider.js and src/cli/account.js read ~/.cresco/config.json token for CrescoDB platform/proxy calls.
Evidence against
- package.json has no install/preinstall/postinstall lifecycle hooks.
- bin/cresco.js is an explicit CLI entrypoint; risky paths are user-invoked through cresco dev/login/agent features.
- src/server/dev-server.js gates admin and /_ai routes to localhost origins.
- src/server/dev-server.js requires explicit approval before run_command executes.
- src/core/agent-fs.js confines file access to the project root and blocks .env/config.json/cresco.db writes.
- No foreign AI-agent control-surface writes, persistence, credential harvesting, or hardcoded exfiltration endpoints found.
Behavioral surface
ChildProcess
Source & flagged code
6 flaggedsrc/server/manifest.jsView file
36patternName = generic_password
severity = medium
line = 36
matchedText = { method...} },
Medium
37patternName = generic_password
severity = medium
line = 37
matchedText = { method...} },
Medium
src/core/adapters/mysql.jsView file
40_poolConfig() {
L41: // Accept a URI; enable multi-statement so exec()/execRaw() DDL scripts run.
L42: const url = new URL(this.connectionString);
High
Child Process
Package source references child process execution.
src/core/adapters/mysql.jsView on unpkg · L40Findings
3 High5 Medium3 Low
HighChild Processsrc/core/adapters/mysql.js
HighShellsrc/core/agent-exec.js
HighSame File Env Network Executionsrc/cli/account.js
MediumSecret Patternsrc/server/manifest.js
MediumDynamic Requiresrc/server/routes-loader.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patternsrc/server/manifest.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to crescodb@0.1.0.
See all versions of crescodb for other recorded verdicts.
- Review the evidence and your use of crescodb@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.