registry / insforge-test / 0.5.3

insforge-test@0.5.3

insforge-test offers isolated, role-aware, and rollback-friendly PostgreSQL environments for integration tests with InsForge defaults baked in

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 7.68 KB of source

Source & flagged code

4 flagged

esm/connect.jsView file

Lines 1-47javascript

1import deepmerge from 'deepmerge';

2import { getPgEnvVars } from 'pg-env';

3import { getConnections as getPgConnections } from 'pgsql-test';

4/**

Source & flagged code

4 flagged · loading source

esm/connect.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...es',

Medium

Secret Pattern

Package contains a possible secret pattern.

esm/connect.jsView on unpkg · L17

27patternName = generic_password severity = medium line = 27 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in esm/connect.js

esm/connect.jsView on unpkg · L27

connect.jsView file

23patternName = generic_password severity = medium line = 23 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L23

33patternName = generic_password severity = medium line = 33 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L33

Findings

4 Medium1 Low

MediumSecret Patternesm/connect.js

MediumSecret Patternconnect.js

LowScripts Present

LPM CLI

Source & flagged code

4 flagged

esm/connect.jsView file

Lines 1-47javascript

1import deepmerge from 'deepmerge';

2import { getPgEnvVars } from 'pg-env';

3import { getConnections as getPgConnections } from 'pgsql-test';

4/**

5 * InsForge default connection options

6 */

7const INSFORGE_DEFAULTS = {

8 roles: {

9 anonymous: 'anon',

10 authenticated: 'authenticated',

11 administrator: 'project_admin',

12 default: 'anon',

13 },

14 connections: {

15 app: {

16 user: 'postgres',

17 password: 'postgres',

Medium

Secret Pattern

Package contains a possible secret pattern.

esm/connect.jsView on unpkg · L17

18 }

19 }

20};

21/**

22 * InsForge default PostgreSQL config

23 */

24const INSFORGE_PG_DEFAULTS = {

25 port: 5432,

26 user: 'postgres',

27 password: 'postgres',

Medium

Secret Pattern

Hardcoded password in esm/connect.js

esm/connect.jsView on unpkg · L27

28};

29/**

30 * Get connections with InsForge defaults applied.

31 * Uses deepmerge for proper nested config merging.

32 *

33 * Precedence (later wins):

34 * 1. InsForge defaults

35 * 2. Environment variables (PGUSER/PGPASSWORD)

36 * 3. User-provided options

37 */

38export const getConnections = async (cn = {}, seedAdapters) => {

39 // Get environment variables (only includes defined keys)

40 const pgEnvVars = getPgEnvVars();

41 // Build env overrides - pgEnvVars already only has defined keys

42 // Mirror user/password to connections.app for the app connection

43 const envOverrides = {

44 pg: pgEnvVars,

45 db: {

46 connections: {

47 app: {

connect.jsView file

Lines 3-53javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.getConnections = void 0;

7const deepmerge_1 = __importDefault(require("deepmerge"));

8const pg_env_1 = require("pg-env");

9const pgsql_test_1 = require("pgsql-test");

10/**

11 * InsForge default connection options

12 */

13const INSFORGE_DEFAULTS = {

14 roles: {

15 anonymous: 'anon',

16 authenticated: 'authenticated',

17 administrator: 'project_admin',

18 default: 'anon',

19 },

20 connections: {

21 app: {

22 user: 'postgres',

23 password: 'postgres',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L23

24 }

25 }

26};

27/**

28 * InsForge default PostgreSQL config

29 */

30const INSFORGE_PG_DEFAULTS = {

31 port: 5432,

32 user: 'postgres',

33 password: 'postgres',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L33

34};

35/**

36 * Get connections with InsForge defaults applied.

37 * Uses deepmerge for proper nested config merging.

38 *

39 * Precedence (later wins):

40 * 1. InsForge defaults

41 * 2. Environment variables (PGUSER/PGPASSWORD)

42 * 3. User-provided options

43 */

44const getConnections = async (cn = {}, seedAdapters) => {

45 // Get environment variables (only includes defined keys)

46 const pgEnvVars = (0, pg_env_1.getPgEnvVars)();

47 // Build env overrides - pgEnvVars already only has defined keys

48 // Mirror user/password to connections.app for the app connection

49 const envOverrides = {

50 pg: pgEnvVars,

51 db: {

52 connections: {

53 app: {