registry / orez / 0.4.52

orez@0.4.52

PGlite-powered zero-sync development backend. No Docker required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 100 file(s), 1.26 MB of source, external domains: 127.0.0.1, orez-do-backend.local, orez.local

Source & flagged code

3 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/native-postgres.jsView file

Lines 34-74javascript

34 '-c',

35 'listen_addresses=127.0.0.1',

36 '-c',

37 'synchronous_commit=off',

38 '-c',

39 'unix_socket_directories=',

40 '-c',

41 'idle_in_transaction_session_timeout=120000',

dist/cf-do/worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orez@0.4.54 matchedIdentity = npm:b3Jleg:0.4.54 similarity = 0.980 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cf-do/worker.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/bench/proxy-throughput.bench.jsView file

181patternName = generic_password severity = medium line = 181 matchedText = const pa...rd';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

dist/native-postgres.jsView file

54function requireFromEmbeddedPostgres(name) { L55: const require = createRequire(import.meta.url); L56: return createRequire(require.resolve('embedded-postgres'))(name);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native-postgres.jsView on unpkg · L54

dist/cf-do/worker.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cf-do/worker.jsView on unpkg

Findings

1 High5 Medium4 Low

HighPrevious Version Dangerous Deltadist/cf-do/worker.js

MediumSecret Patterndist/bench/proxy-throughput.bench.js

MediumDynamic Requiredist/native-postgres.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/native-postgres.jsView file

Lines 34-74javascript

34 '-c',

35 'listen_addresses=127.0.0.1',

36 '-c',

37 'synchronous_commit=off',

38 '-c',

39 'unix_socket_directories=',

40 '-c',

41 'idle_in_transaction_session_timeout=120000',

dist/cf-do/worker.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cf-do/worker.jsView on unpkg