crescodb@1.0.0
⚠ Under reviewInstant local backend — SQLite + auto REST API + AI schema generation
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedsrc/server/manifest.jsView file
36patternName = generic_password
severity = medium
line = 36
matchedText = { method...} },
Medium
37patternName = generic_password
severity = medium
line = 37
matchedText = { method...} },
Medium
src/core/adapters/mysql.jsView file
40_poolConfig() {
L41: // Accept a URI; enable multi-statement so exec()/execRaw() DDL scripts run.
L42: const url = new URL(this.connectionString);
High
Child Process
Package source references child process execution.
src/core/adapters/mysql.jsView on unpkg · L40Findings
1 Critical5 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/cli/deploy.js
HighChild Processsrc/core/adapters/mysql.js
HighShellsrc/core/agent-exec.js
HighEntrypoint Foreign Package Code Overwritesrc/cli/deploy.js
HighCommand Output Exfiltrationsrc/cli/deploy.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationsrc/cli/deploy.js#virtual:normalized:round1
MediumSecret Patternsrc/server/manifest.js
MediumDynamic Requirebin/cresco.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patternsrc/server/manifest.js
LowScripts Present
Affected versions and remediation
This report applies to crescodb@1.0.0.
See all versions of crescodb for other recorded verdicts.
- Review the evidence and your use of crescodb@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.