registry / orez / 0.4.35

orez@0.4.35

PGlite-powered zero-sync development backend. No Docker required.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 97 file(s), 1.21 MB of source, external domains: 127.0.0.1, orez-do-backend.local, orez.local

Source & flagged code

3 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/worker/zero-cache-embed.jsView file

Lines 119-159javascript

119 disableZeroLitestreamRestore();

120 // keep zero-cache's changeLog cleanup retrying if its first cleanup tick runs

121 // before any subscriber ACK exists. must run before the dynamic import below.

122 enableZeroChangeLogCleanupRetry();

123 // embed restart contract (see ./embed-generation.ts): track every sqlite

124 // handle zero-cache opens (pure-tracking patch, must land before the

125 // dynamic import below loads zqlite), then reclaim whatever a dead prior

126 // generation in this process left open — zero-cache relies on

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orez@0.4.33 matchedIdentity = npm:b3Jleg:0.4.33 similarity = 0.936 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/bench/proxy-throughput.bench.jsView file

181patternName = generic_password severity = medium line = 181 matchedText = const pa...rd';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

dist/worker/zero-cache-embed.jsView file

139// so we resolve the full filesystem path and import directly. L140: const { createRequire } = await import('node:module'); L141: const require = createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/worker/zero-cache-embed.jsView on unpkg · L139

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 High5 Medium4 Low

HighPrevious Version Dangerous Deltadist/index.js

MediumSecret Patterndist/bench/proxy-throughput.bench.js

MediumDynamic Requiredist/worker/zero-cache-embed.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/worker/zero-cache-embed.jsView file

Lines 119-159javascript

119 disableZeroLitestreamRestore();

120 // keep zero-cache's changeLog cleanup retrying if its first cleanup tick runs

121 // before any subscriber ACK exists. must run before the dynamic import below.

122 enableZeroChangeLogCleanupRetry();

123 // embed restart contract (see ./embed-generation.ts): track every sqlite

124 // handle zero-cache opens (pure-tracking patch, must land before the

125 // dynamic import below loads zqlite), then reclaim whatever a dead prior

126 // generation in this process left open — zero-cache relies on

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg