registry / slintorm / 1.1.7

slintorm@1.1.7

Minimal fully typed orm for typescript

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 660 KB of source, external domains: api.planetscale.com, flutterwave.com, grow.google, konga.com, learn.microsoft.com, learndigital.withgoogle.com, linkedin.com, meet.google.com, mode.com, overthewire.org, paystack.com, skillshop.google.com, sqlzoo.net, tryhackme.com, www.facebook.com, www.isc2.org, www.netacad.com, www.semrush.com

Source & flagged code

3 flagged

dist/src/bin/cli.jsView file

Lines 87-127javascript

87 path.join(cwd, "slintorm.config.js"),

88 path.join(cwd, "slintorm.config.mjs"),

89 path.join(cwd, "slintorm.config.cjs"),

90 path.join(cwd, "slintorm.config.ts"),

91 path.join(cwd, "slintorm.config.json"),

92 ];

93 const legacyCandidates = [

94 path.join(cwd, "orm.config.js"),

95 path.join(cwd, "orm.config.mjs"),

96 path.join(cwd, "orm.config.cjs"),

97 path.join(cwd, "orm.config.ts"),

98 path.join(cwd, "orm.config.json"),

99 ];

100 for (const cfgPath of primaryCandidates) {

101 if (!fs.existsSync(cfgPath))

102 continue;

103 info(`Loading config: ${path.basename(cfgPath)}`);

104 if (cfgPath.endsWith(".json")) {

105 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

106 }

107 try {

108 const mod = await import(pathToFileURL(cfgPath).href);

109 const cfg = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/bin/cli.jsView on unpkg · L107

110 if (cfg && typeof cfg === "object")

111 return cfg;

112 }

113 catch (e) {

114 fail(`Failed to load config from ${cfgPath}: ${e.message}`);

115 process.exit(1);

116 }

117 }

118 for (const cfgPath of legacyCandidates) {

119 if (!fs.existsSync(cfgPath))

120 continue;

121 warn(`Found ${path.basename(cfgPath)} — this name is deprecated. ` +

122 `Please rename it to slintorm.config.${cfgPath.split(".").pop()}.`);

123 if (cfgPath.endsWith(".json")) {

124 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

125 }

126 try {

127 const mod = await import(pathToFileURL(cfgPath).href);

Lines 393-433javascript

393 if (m) {

394 try {

395 await db.collection(m[1]).drop();

396 }

397 catch {

398 // collection may not exist — non-fatal

399 }

400 }

401 return { rows: [] };

Lines 875-915javascript

875 await exec(`DROP TABLE IF EXISTS "${tableName}"`);

876 await exec(`DELETE FROM "${MIGRATIONS_TABLE}" WHERE name = ${isPg ? "$1" : "?"}`, [name]);

877 removeMigrationRecord(cfg.dir ?? "src", name);

878 rolledBack++;

Source & flagged code

3 flagged · loading source

dist/src/bin/cli.jsView file

413// creates a unique index on `name` in the migrations collection. L414: await exec(`CREATE TABLE "${MIGRATIONS_TABLE}"`); L415: return;

High

Child Process

Package source references child process execution.

dist/src/bin/cli.jsView on unpkg · L413

895warn(`No schema snapshot found for batch ${targetBatch}; cannot rebuild previous tables automatically.`); L896: warn("Update your source files to match that point in history, then re-run `npx slintorm migrate`."); L897: } ... L907: await migrator.ensureTable(unit.tableName, modelDef.fields, modelDef.relations ?? []); L908: await exec(`INSERT INTO "${MIGRATIONS_TABLE}" (name, batch) VALUES (${isPg ? "$1,$2" : "?,?"})`, [unit.name, targetBatch]); L909: writeMigrationRecord(cfg.dir ?? "src", unit, targetBatch, modelDef);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/bin/cli.jsView on unpkg · L895

107try { L108: const mod = await import(pathToFileURL(cfgPath).href); L109: const cfg = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/bin/cli.jsView on unpkg · L107

Findings

3 High3 Medium5 Low

HighChild Processdist/src/bin/cli.js

HighShell

HighRuntime Package Installdist/src/bin/cli.js

MediumDynamic Requiredist/src/bin/cli.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/src/bin/cli.jsView file

Lines 87-127javascript

87 path.join(cwd, "slintorm.config.js"),

88 path.join(cwd, "slintorm.config.mjs"),

89 path.join(cwd, "slintorm.config.cjs"),

90 path.join(cwd, "slintorm.config.ts"),

91 path.join(cwd, "slintorm.config.json"),

92 ];

93 const legacyCandidates = [

94 path.join(cwd, "orm.config.js"),

95 path.join(cwd, "orm.config.mjs"),

96 path.join(cwd, "orm.config.cjs"),

97 path.join(cwd, "orm.config.ts"),

98 path.join(cwd, "orm.config.json"),

99 ];

100 for (const cfgPath of primaryCandidates) {

101 if (!fs.existsSync(cfgPath))

102 continue;

103 info(`Loading config: ${path.basename(cfgPath)}`);

104 if (cfgPath.endsWith(".json")) {

105 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

106 }

107 try {

108 const mod = await import(pathToFileURL(cfgPath).href);

109 const cfg = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/bin/cli.jsView on unpkg · L107

110 if (cfg && typeof cfg === "object")

111 return cfg;

112 }

113 catch (e) {

114 fail(`Failed to load config from ${cfgPath}: ${e.message}`);

115 process.exit(1);

116 }

117 }

118 for (const cfgPath of legacyCandidates) {

119 if (!fs.existsSync(cfgPath))

120 continue;

121 warn(`Found ${path.basename(cfgPath)} — this name is deprecated. ` +

122 `Please rename it to slintorm.config.${cfgPath.split(".").pop()}.`);

123 if (cfgPath.endsWith(".json")) {

124 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

125 }

126 try {

127 const mod = await import(pathToFileURL(cfgPath).href);

Lines 393-433javascript

393 if (m) {

394 try {

395 await db.collection(m[1]).drop();

396 }

397 catch {

398 // collection may not exist — non-fatal

399 }

400 }

401 return { rows: [] };

Lines 875-915javascript

875 await exec(`DROP TABLE IF EXISTS "${tableName}"`);

876 await exec(`DELETE FROM "${MIGRATIONS_TABLE}" WHERE name = ${isPg ? "$1" : "?"}`, [name]);

877 removeMigrationRecord(cfg.dir ?? "src", name);

878 rolledBack++;