crescodb@0.2.8
Upgrade to crescodb@latest — versions below 1.0.0 are no longer supported and will be refused by the platform.
Instant local backend — SQLite + auto REST API + AI schema generation
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection found no covert installation hook, remote payload loading, credential harvesting, or exfiltration chain. The package nevertheless embeds an approval-bypassable, unsandboxed AI command runner, so it warrants a warning for dangerous runtime capability rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `cresco dev` and uses the localhost AI-agent interface; auto-execution requires its runtime setting.
Impact
An agent prompt or compromised AI response could execute commands with the developer's privileges when auto-run is enabled.
Mechanism
Local AI-agent project editing and shell-command execution.
AI rationale
Source inspection found no covert installation hook, remote payload loading, credential harvesting, or exfiltration chain. The package nevertheless embeds an approval-bypassable, unsandboxed AI command runner, so it warrants a warning for dangerous runtime capability rather than a publish block.
Evidence
package.jsonsrc/core/agent-exec.jssrc/core/agent-fs.jssrc/server/dev-server.jssrc/server/routes-loader.jssrc/ai/provider.jssrc/core/platform-url.js~/.cresco/config.json<project-root>/.env<project-root>/config.json<project-root>/cresco.db<project-root>/cresco.routes.js
Network endpoints1
api.crescodb.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `src/core/agent-exec.js` runs arbitrary shell commands in the project with developer privileges.
- `src/server/dev-server.js` can auto-run agent-requested commands when its owner setting enables it.
- `src/ai/provider.js` reads `~/.cresco/config.json` for a login token and sends AI requests to the package platform.
Evidence against
- `package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
- AI filesystem operations are project-root constrained and refuse `.env`, `config.json`, and database files in `src/core/agent-fs.js`.
- Custom-route dynamic import loads the developer project's supplied routes file, not a remote payload.
- Observed platform host is package-aligned: `https://api.crescodb.com`.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
3 flaggedsrc/server/manifest.jsView file
36patternName = generic_password
severity = medium
line = 36
matchedText = { method...} },
Medium
37patternName = generic_password
severity = medium
line = 37
matchedText = { method...} },
Medium
src/server/routes-loader.jsView file
22try {
L23: const mod = await import(pathToFileURL(routesPath).href + '?t=' + Date.now());
L24: defs = mod.default || mod.routes || [];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/server/routes-loader.jsView on unpkg · L22Findings
5 Medium4 Low
MediumSecret Patternsrc/server/manifest.js
MediumDynamic Requiresrc/server/routes-loader.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patternsrc/server/manifest.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to crescodb@0.2.8.
See all versions of crescodb for other recorded verdicts.
- Review the evidence and your use of crescodb@0.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.