registry / schematic-pg / 0.1.10
schematic-pg@0.1.10
Single-file backend framework for PostgreSQL and Node.js
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic source inspection shows a conventional explicit CLI for scaffolding, code generation, server startup, and PostgreSQL migration management. Potentially sensitive actions are user-invoked and package-aligned, with no install-time execution or concrete malicious chain.
Static reason
No blocking static signals were detected.
Trigger
User runs CLI commands such as `init`, `generate`, `dev`, `start`, or database commands.
Impact
Expected user-directed project files and database schema may be created or changed; no stealth persistence, credential exfiltration, or remote payload execution was identified.
Mechanism
Explicit schema-project generation, local process orchestration, and PostgreSQL operations.
AI rationale
Static source inspection shows a conventional explicit CLI for scaffolding, code generation, server startup, and PostgreSQL migration management. Potentially sensitive actions are user-invoked and package-aligned, with no install-time execution or concrete malicious chain.
Evidence
package.jsondist/cli.jsdist/cli/init.jsdist/cli/hooks.jsdist/cli/server.jsdist/db/load-env.jsdist/cli/dev.jsdist/cli/start.jsdist/db/migrations.jsdist/db/schema-state.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- `package.json` has no preinstall/install/postinstall lifecycle hook.
- `dist/cli.js` only dispatches explicit CLI commands.
- `dist/cli/init.js` runs `npm install` and `git init` only after explicit `init`; it scaffolds the chosen directory.
- `dist/cli/hooks.js` writes only an explicit user-requested hook file under `src/hooks/`.
- `dist/db/load-env.js` reads only the current project's `.env`; no exfiltration path was found.
- No remote loader, eval/vm use, or non-package network endpoint was found in `dist/`.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 Medium3 Low
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to schematic-pg@0.1.10.
See all versions of schematic-pg for other recorded verdicts.
- Review the evidence and your use of schematic-pg@0.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.