registry / orez / 0.5.26

orez@0.5.26

PGlite-powered zero-sync development backend. No Docker required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 119 file(s), 1.55 MB of source, external domains: 127.0.0.1, orez-do-backend.local, orez-sqlite.local, orez.local

Source & flagged code

4 flagged

dist/bench/proxy-throughput.bench.jsView file

Lines 161-201javascript

161 avgLatencyMs: allLatencies.reduce((s, v) => s + v, 0) / ops,

162 p50Ms: percentile(allLatencies, 0.5),

163 p99Ms: percentile(allLatencies, 0.99),

164 };

165}

166async function run() {

167 console.log('\n=== Proxy Throughput Benchmark ===\n');

168 const pgPort = 25000 + Math.floor(Math.random() * 1000);

169 const zeroPort = pgPort + 100;

170 const dataDir = `.orez-bench-proxy-${Date.now()}`;

171 console.log(`starting orez (pg:${pgPort}, skipZero)...`);

172 const result = await startZeroLite({

173 pgPort,

174 zeroPort,

175 dataDir,

176 logLevel: 'error',

177 skipZeroCache: true, // pure proxy benchmark, no zero-cache overhead

178 });

179 const db = result.db;

180 const user = 'user';

181 const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/bench/proxy-throughput.bench.jsView on unpkg · L181

182 try {

183 // set up test table

184 await db.exec(`

185 CREATE TABLE bench_rows (

186 id SERIAL PRIMARY KEY,

187 value TEXT,

188 num INTEGER

189 );

190 INSERT INTO bench_rows (value, num)

191 SELECT 'row-' || i, i FROM generate_series(1, 1000) AS i;

192 `);

193 // warmup

194 const warmupSocket = await connectPg(pgPort, user, password);

195 for (let i = 0; i < 50; i++) {

196 await sendQuery(warmupSocket, 'SELECT 1');

197 }

198 warmupSocket.destroy();

199 const results = [];

200 // --- serial benchmarks (1 connection) ---

201 console.log('running serial benchmarks...');

dist/native-postgres.jsView file

Lines 34-74javascript

34 '-c',

35 'listen_addresses=127.0.0.1',

36 '-c',

37 'synchronous_commit=off',

38 '-c',

39 'unix_socket_directories=',

40 '-c'

dist/sync-browser-host/generated/sqlite3-browser.wasmView file

•path = dist/sync-browser-host/generated/sqlite3-browser.wasm kind = wasm_module sizeBytes = 1511280 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sync-browser-host/generated/sqlite3-browser.wasmView on unpkg

dist/cf-do/worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orez@0.5.25 matchedIdentity = npm:b3Jleg:0.5.25 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cf-do/worker.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/bench/proxy-throughput.bench.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code