jsql-neo@5.1.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

jsql-neo@5.1.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/sqlite_worker.jsView file

175// eslint-disable-next-line no-new-func L176: const fn = new Function('return (' + fnStr + ')')(); L177: userFunctions[String(name).toUpperCase()] = fn;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/sqlite_worker.jsView on unpkg · L175

bin/jsql-server-control.jsView file

4L5: const fs = require('fs'); L6: const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/jsql-server-control.jsView on unpkg · L4

lib/mysql_server.jsView file

6L7: const net = require('net'); L8: const crypto = require('crypto'); ... L34: if (typeof value === 'bigint') value = Number(value); L35: if (value === null) return Buffer.from([0xfb]); L36: if (value < 0xfb) return Buffer.from([value]); ... L427: this.sequence = (this.sequence + 1) & 0xff; L428: this.socket.write(Buffer.concat([header, payload])); L429: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/mysql_server.jsView on unpkg · L6

native/jsql-neo-native.nodeView file

•path = native/jsql-neo-native.node kind = native_binary sizeBytes = 1256280 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/jsql-neo-native.nodeView on unpkg

wasm/jsql_neo_wasm_bg.wasmView file

•path = wasm/jsql_neo_wasm_bg.wasm kind = wasm_module sizeBytes = 343705 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/jsql_neo_wasm_bg.wasmView on unpkg

bin/jsqlView file

•matchType = previous_version_dangerous_delta matchedPackage = jsql-neo@5.0.1 matchedIdentity = npm:anNxbC1uZW8:5.0.1 similarity = 0.676 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/jsqlView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 28-68json

28 "./sqlite": "./lib/sqlite_compat.js"

29 },

30 "bin": {

31 "jsql": "./bin/jsql"

32 },

33 "files": [

34 "index.js",

35 "index.d.ts",

36 "lib/",

37 "bin/",

38 "wasm/",

39 "native/",

40 "nativesrc/",

41 "!nativesrc/**/target/",

42 "postinstall.js",

43 "test/",

44 "README.md",

45 "LICENSE"

46 ],

47 "scripts": {

48 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 "test": "node test/smoke.js",

50 "test:coverage": "c8 --all --include='lib/**' --exclude='lib/mysql_server.js' --exclude='lib/native_client.js' --exclude='lib/wasm_client.js' --exclude='lib/mysql_compat.js' --exclude='lib/nedb_compat.js' --exclude='lib/plugin.js' --reporter=text --reporter=lcov node test/coverage.js",

51 "test:orms": "node examples/orms/run-all.js"

52 },

53 "keywords": [

54 "database",

55 "sql",

56 "embedded",

57 "rust",

58 "wasm",

59 "json",

60 "javascript",

61 "jsql",

62 "nosql",

63 "rest-api",

64 "high-performance"

65 ],

66 "author": "Vexify",

67 "license": "Apache-2.0",

68 "repository": {

lib/sqlite_worker.jsView file

Lines 155-195javascript

155 type: 'TEXT',

156 column: name,

157 table: r && r.table ? r.table : null,

158 database: null,

bin/jsql-server-control.jsView file

Lines 1-24javascript

1// © Vexify 2026 All Rights Reserved.

2// jsql server start/stop/status — 后台常驻服务控制（对标 `net mysql80 start`）。

3// 状态文件放在 ~/.jsql/ 下：server.pid / server.log / server.json（保存启动配置）。

4

5const fs = require('fs');

6const os = require

lib/mysql_server.jsView file

Lines 1-26javascript

1// © Vexify 2026 All Rights Reserved.

2/**

3 * MySQL 协议服务端 — TCP 3306

4 * 实现 MySQL 握手/认证/命令循环，任何 mysql/mysql2 客户端可直接连接。

5 */

6

7const net = require('net');

8const crypto

native/jsql-neo-native.nodeView file

•path = native/jsql-neo-native.node kind = native_binary sizeBytes = 1256280 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/jsql-neo-native.nodeView on unpkg

wasm/jsql_neo_wasm_bg.wasmView file

•path = wasm/jsql_neo_wasm_bg.wasm kind = wasm_module sizeBytes = 343705 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/jsql_neo_wasm_bg.wasmView on unpkg

bin/jsqlView file

•matchType = previous_version_dangerous_delta matchedPackage = jsql-neo@5.0.1 matchedIdentity = npm:anNxbC1uZW8:5.0.1 similarity = 0.676 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/jsqlView on unpkg