registry / jsql-neo / 4.5.2

jsql-neo@4.5.2

JSQL-NEO — Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

npm installation can invoke Cargo in an adjacent, foreign project when the package server binary is absent. This creates install-time code-execution exposure from a sibling directory, not a confirmed payload in this package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install with no bin/jsql-neo-server and a sibling ../jsql-neo-server/Cargo.toml

Impact

A controllable sibling Cargo project could run with installer privileges.

Mechanism

postinstall executes cargo build in a foreign sibling directory

AI rationale

This is not proven package malware, but its install hook executes an unrelated adjacent project under a condition common enough to create a real supply-chain code-execution risk.

Evidence

package.jsonpostinstall.jsbin/jsqlbin/jsql-server-control.jslib/mod.jslib/client.jsnativesrc/jsql-neo-native/src/lib.rsbin/jsql-neo-server../jsql-neo-server/Cargo.toml

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

jsql-neo@4.5.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code