crescodb@1.2.1
⚠ Under reviewYour whole backend in a few commands: auto-generated REST API, auth with roles, file storage and realtime over SQLite, PostgreSQL or MySQL. Runs locally, deploys to a server you own, and ejects in one command.
Static Scan Results
scanned 25d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedsrc/server/manifest.jsView file
41patternName = generic_password
severity = medium
line = 41
Medium
42patternName = generic_password
severity = medium
line = 42
Medium
bin/cresco.jsView file
9// loaded (and crashed with an unreadable node-gyp/ABI error). A dynamic
L10: // `await import()` is what lets us fail first, with a message a human can act on.
L11: //
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cresco.jsView on unpkg · L9Findings
2 High5 Medium5 Low
HighSemantic Analysis Limitedsrc/cli/install.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/cli/eject.js
MediumSecret Patternsrc/server/manifest.js
MediumDynamic Requirebin/cresco.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patternsrc/server/manifest.js
LowScripts Present
LowWeak Cryptosrc/server/monitor.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to crescodb@1.2.1.
See all versions of crescodb for other recorded verdicts.
- Review the evidence and your use of crescodb@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.