crescodb@0.2.7
Upgrade to crescodb@latest — versions below 1.0.0 are no longer supported and will be refused by the platform.
Instant local backend — SQLite + auto REST API + AI schema generation
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection found a user-invoked local development platform, including an approval-gated AI agent, but no lifecycle execution or concrete malicious chain. Scanner signals reflect legitimate dynamic project-route loading, AI networking, and placeholder credentials.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `cresco dev` and uses the local `/_ai` dashboard feature; AI requests require user invocation/login or configured provider keys.
Impact
An approved agent command can affect the user's project, but no stealth persistence, credential harvesting, foreign agent-config mutation, or unconsented execution was found.
Mechanism
Approval-gated local agent tools and package-aligned hosted AI proxy.
AI rationale
Source inspection found a user-invoked local development platform, including an approval-gated AI agent, but no lifecycle execution or concrete malicious chain. Scanner signals reflect legitimate dynamic project-route loading, AI networking, and placeholder credentials.
Evidence
package.jsonbin/cresco.jssrc/core/agent-exec.jssrc/core/agent-fs.jssrc/ai/provider.jssrc/server/dev-server.jssrc/server/routes-loader.jssrc/server/manifest.jssrc/cli/ai.js
Network endpoints1
api.crescodb.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `src/core/agent-exec.js` runs shell commands in the project after agent approval.
- `src/core/agent-fs.js` permits project-scoped file writes and deletes.
- `src/ai/provider.js` sends AI requests to `https://api.crescodb.com` when user invokes AI features.
Evidence against
- `package.json` has no preinstall/install/postinstall lifecycle hooks.
- `bin/cresco.js` exposes behavior through explicit CLI commands.
- `src/server/dev-server.js` gates `/_ai` tooling to localhost/first-party origins.
- `src/core/agent-fs.js` confines paths to the project and blocks `.env`, `config.json`, and database writes.
- `src/server/routes-loader.js` imports only the project's explicit custom routes file during dev reload.
- `src/server/manifest.js` contains example credentials, not a secret or exfiltration path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
4 flaggedsrc/server/manifest.jsView file
36patternName = generic_password
severity = medium
line = 36
matchedText = { method...} },
Medium
37patternName = generic_password
severity = medium
line = 37
matchedText = { method...} },
Medium
src/server/routes-loader.jsView file
22try {
L23: const mod = await import(pathToFileURL(routesPath).href + '?t=' + Date.now());
L24: defs = mod.default || mod.routes || [];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/server/routes-loader.jsView on unpkg · L22Findings
1 High5 Medium4 Low
HighPrevious Version Dangerous Deltasrc/cli/dev.js
MediumSecret Patternsrc/server/manifest.js
MediumDynamic Requiresrc/server/routes-loader.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patternsrc/server/manifest.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to crescodb@0.2.7.
See all versions of crescodb for other recorded verdicts.
- Review the evidence and your use of crescodb@0.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.