rxdb-premium@17.4.0

RxDB Premium

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chain

TrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 614 B of source, external domains: premium.rxdb.info

Source & flagged code

2 flagged

package.jsonView file

Lines 3-43json

3 "version": "17.4.0",

4 "private": false,

5 "description": "RxDB Premium",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/pubkey/rxdb.git"

9 },

10 "bugs": {

11 "url": "https://github.com/pubkey/rxdb/issues"

12 },

13 "keywords": [

14 "rxdb"

15 ],

16 "author": "pubkey",

17 "homepage": "https://rxdb.info/premium",

18 "peerDependencies": {

19 "rxdb": "17.4.0",

20 "rxjs": "*"

21 },

22 "scripts": {

23 "postinstall": "node ./scripts/postinstall.js && node ./scripts/installer.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "exports": {

26 ".": {

27 "types": "./dist/types/index.d.ts",

28 "require": "./dist/cjs/index.js",

29 "import": "./dist/esm/index.js",

30 "default": "./dist/esm/index.js"

31 },

32 "./plugins/shared": {

33 "types": "./dist/types/plugins/shared/index.d.ts",

34 "require": "./dist/cjs/plugins/shared/index.js",

35 "import": "./dist/esm/plugins/shared/index.js",

36 "default": "./dist/esm/plugins/shared/index.js"

37 },

38 "./plugins/storage-indexeddb": {

39 "types": "./dist/types/plugins/storage-indexeddb/index.d.ts",

40 "require": "./dist/cjs/plugins/storage-indexeddb/index.js",

41 "import": "./dist/esm/plugins/storage-indexeddb/index.js",

42 "default": "./dist/esm/plugins/storage-indexeddb/index.js"

43 },

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js && node ./scripts/installer.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.js && node ./scripts/installer.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to rxdb-premium@17.4.0.

See all versions of rxdb-premium for other recorded verdicts.

Review the evidence and your use of rxdb-premium@17.4.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-13 13:35:54.778Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.