jsql-neo@6.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

jsql-neo@6.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/sqlite_worker.jsView file

179// eslint-disable-next-line no-new-func L180: const fn = new Function('return (' + fnStr + ')')(); L181: userFunctions[String(name).toUpperCase()] = fn;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/sqlite_worker.jsView on unpkg · L179

bin/jsql-server-control.jsView file

4L5: const fs = require('fs'); L6: const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/jsql-server-control.jsView on unpkg · L4

lib/mysql_server.jsView file

6L7: const net = require('net'); L8: const crypto = require('crypto'); ... L34: if (typeof value === 'bigint') value = Number(value); L35: if (value === null) return Buffer.from([0xfb]); L36: if (value < 0xfb) return Buffer.from([value]); ... L427: this.sequence = (this.sequence + 1) & 0xff; L428: this.socket.write(Buffer.concat([header, payload])); L429: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/mysql_server.jsView on unpkg · L6

postinstall.jsView file

1const { execSync } = require('child_process'); L2: const fs = require('fs'); L3: const path = require('path'); L4: const http = require('http'); L5: const https = require('https'); L6: L7: const ROOT = __dirname; L8: const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')); L9: L10: // Server CLI binary (bin/jsql-neo-server) L11: const BIN_NAME = process.platform === 'win32' ? 'jsql-neo-server.exe' : 'jsql-neo-server'; L12: const BP = path.join(ROOT, 'bin', BIN_NAME);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

postinstall.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = jsql-neo@5.3.1 matchedIdentity = npm:anNxbC1uZW8:5.3.1 similarity = 0.447 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.jsView on unpkg

native/jsql-neo-native.nodeView file

•path = native/jsql-neo-native.node kind = native_binary sizeBytes = 854864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/jsql-neo-native.nodeView on unpkg

wasm/jsql_neo_wasm_bg.wasmView file

•path = wasm/jsql_neo_wasm_bg.wasm kind = wasm_module sizeBytes = 325490 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/jsql_neo_wasm_bg.wasmView on unpkg

lib/database.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/database.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 27-67json

27 "./sqlite": "./lib/sqlite_compat.js"

28 },

29 "bin": {

30 "jsql": "./bin/jsql"

31 },

32 "files": [

33 "index.js",

34 "index.d.ts",

35 "lib/",

36 "bin/",

37 "wasm/",

38 "native/",

39 "nativesrc/",

40 "!nativesrc/**/target/",

41 "postinstall.js",

42 "test/",

43 "README.md",

44 "LICENSE"

45 ],

46 "scripts": {

47 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "test": "node test/smoke.js && node test/sql-parser.test.js && node test/query-opt.test.js",

49 "test:parser": "node test/sql-parser.test.js",

50 "test:btree": "node test/btree.test.js",

51 "test:native": "node test/native.test.js",

52 "test:regress": "node test/regress-5.1.0.js",

53 "test:all": "node test/smoke.js && node test/sql-parser.test.js && node test/native.test.js && node test/wasm.test.js && node test/coverage.js && node test/regress-5.1.0.js && node test/join.test.js && node test/btree.test.js",

54 "test:coverage": "c8 --all --include='lib/**' --exclude='lib/mysql_server.js' --exclude='lib/native_client.js' --exclude='lib/wasm_client.js' --exclude='lib/mysql_compat.js' --exclude='lib/nedb_compat.js' --exclude='lib/plugin.js' --reporter=text --reporter=lcov node test/coverage.js",

55 "test:orms": "node examples/orms/run-all.js"

56 },

57 "keywords": [

58 "database",

59 "sql",

60 "embedded",

61 "rust",

62 "wasm",

63 "json",

64 "javascript",

65 "jsql",

66 "nosql",

67 "rest-api",

lib/sqlite_worker.jsView file

Lines 159-199javascript

159 type: 'TEXT',

160 column: name,

161 table: r && r.table ? r.table : null,

162 database: null,

bin/jsql-server-control.jsView file

Lines 1-24javascript

1// © Vexify 2026 All Rights Reserved.

2// jsql server start/stop/status — 后台常驻服务控制（对标 `net mysql80 start`）。

3// 状态文件放在 ~/.jsql/ 下：server.pid / server.log / server.json（保存启动配置）。

4

5const fs = require('fs');

6const os = require

lib/mysql_server.jsView file

Lines 1-26javascript

1// © Vexify 2026 All Rights Reserved.

2/**

3 * MySQL 协议服务端 — TCP 3306

4 * 实现 MySQL 握手/认证/命令循环，任何 mysql/mysql2 客户端可直接连接。

5 */

6

7const net = require('net');

8const crypto

postinstall.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const fs = require('fs');

3const path = require

native/jsql-neo-native.nodeView file

•path = native/jsql-neo-native.node kind = native_binary sizeBytes = 854864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/jsql-neo-native.nodeView on unpkg

wasm/jsql_neo_wasm_bg.wasmView file

•path = wasm/jsql_neo_wasm_bg.wasm kind = wasm_module sizeBytes = 325490 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/jsql_neo_wasm_bg.wasmView on unpkg

lib/database.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/database.js#virtual:normalized:round1View on unpkg