registry  /  dbbackuper  /  1.2.5

dbbackuper@1.2.5

You can backup your database easily using this module

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. Runtime behavior is a database backup/restore tool that connects to user-provided database hosts and reads/writes local backup artifacts when explicitly invoked.

Static reason
One or more suspicious static signals were detected.
Trigger
User imports the package and calls the exported async function with database config and backup path.
Impact
Can create zip backups, restore database rows/schema, and in full restore mode move project files as part of backup restoration; no unsolicited exfiltration or install-time execution found.
Mechanism
User-invoked local database backup/restore
Rationale
The suspicious primitives are aligned with a database backup/restore package and are activated only by explicit user calls with supplied DB credentials/paths. No lifecycle hook, hidden network exfiltration, credential harvesting, dynamic code execution, persistence, or AI-agent control-surface mutation was found.
Evidence
package.jsonindex.jscreatebackup.jsupload.jsfilefunctions.jsgetmetadata.jsgetrows.jsuploaddata.jsvalidateUploads.jscheckdiskspace.jslinks.jsbackupfilesbackupfiles/backupbackupfiles/backup/databasebackupfiles/backup/database/filesbackupfiles/backup/programfilesuser-specified zip/output path

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json declares fs/path dependencies matching Node built-ins, but source imports built-ins normally
  • upload.js can move project files during full restore, but only from user-supplied backup workflow
Evidence against
  • package.json has no install/preinstall/postinstall lifecycle scripts and main is index.js
  • index.js only exports an async backup/restore function; no import-time execution observed
  • rg found no child_process, eval, Function, fetch/axios/request, process.env, ssh, or npmrc harvesting
  • createbackup.js writes database metadata/rows to local backupfiles and zips them to a user path
  • upload.js restores a user-supplied zip and validates dbtaskerdata.json before database writes
  • No hardcoded exfiltration endpoint or credential collection beyond user-provided DB config
Behavioral surface
Source
Filesystem
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 12 file(s), 301 KB of source

Source & flagged code

1 flagged · loading source
package.jsonView file
•Runtime dependency names matching Node built-ins: fs, path, stream
High
Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

1 High3 Low
HighNode Builtin Dependency Squatpackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings