registry / orez / 0.4.37

orez@0.4.37

PGlite-powered zero-sync development backend. No Docker required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 97 file(s), 1.21 MB of source, external domains: 127.0.0.1, orez-do-backend.local, orez.local

Source & flagged code

2 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/native-postgres.jsView file

Lines 14-54javascript

14const ZERO_DATABASES = ['zero_cvr', 'zero_cdb'];

15// wal_level=logical is required by zero-cache's change source.

16// synchronous_commit=off matches the durability posture of the pglite

17// backend (relaxedDurability): fast writes, no corruption risk, at most the

18// last moments of commits lost on a hard crash.

19const SERVER_FLAGS = [

20 '-c',

Source & flagged code

2 flagged · loading source

dist/bench/proxy-throughput.bench.jsView file

181patternName = generic_password severity = medium line = 181 matchedText = const pa...rd';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

dist/native-postgres.jsView file

34function requireFromEmbeddedPostgres(name) { L35: const require = createRequire(import.meta.url); L36: return createRequire(require.resolve('embedded-postgres'))(name);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native-postgres.jsView on unpkg · L34

Findings

5 Medium4 Low

MediumSecret Patterndist/bench/proxy-throughput.bench.js

MediumDynamic Requiredist/native-postgres.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/native-postgres.jsView file

Lines 14-54javascript

14const ZERO_DATABASES = ['zero_cvr', 'zero_cdb'];

15// wal_level=logical is required by zero-cache's change source.

16// synchronous_commit=off matches the durability posture of the pglite

17// backend (relaxedDurability): fast writes, no corruption risk, at most the

18// last moments of commits lost on a hard crash.

19const SERVER_FLAGS = [

20 '-c',