registry / slintorm / 1.6.1

slintorm@1.6.1

Minimal fully typed orm for typescript

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 736 KB of source, external domains: api.planetscale.com, flutterwave.com, grow.google, konga.com, learn.microsoft.com, learndigital.withgoogle.com, linkedin.com, meet.google.com, mode.com, overthewire.org, paystack.com, skillshop.google.com, sqlzoo.net, tryhackme.com, www.facebook.com, www.isc2.org, www.netacad.com, www.semrush.com

Source & flagged code

3 flagged

dist/src/bin/cli.jsView file

Lines 133-173javascript

133 path.join(cwd, "slintorm.config.js"),

134 path.join(cwd, "slintorm.config.mjs"),

135 path.join(cwd, "slintorm.config.cjs"),

136 path.join(cwd, "slintorm.config.ts"),

137 path.join(cwd, "slintorm.config.json"),

138 ];

139 const legacyCandidates = [

140 path.join(cwd, "orm.config.js"),

141 path.join(cwd, "orm.config.mjs"),

142 path.join(cwd, "orm.config.cjs"),

143 path.join(cwd, "orm.config.ts"),

144 path.join(cwd, "orm.config.json"),

145 ];

146 for (const cfgPath of primaryCandidates) {

147 if (!fs.existsSync(cfgPath))

148 continue;

149 info(`Loading config: ${path.basename(cfgPath)}`);

150 if (cfgPath.endsWith(".json")) {

151 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

152 }

153 try {

154 const mod = await import(pathToFileURL(cfgPath).href);

155 const cfg = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/bin/cli.jsView on unpkg · L153

156 if (cfg && typeof cfg === "object")

157 return cfg;

158 }

159 catch (e) {

160 fail(`Failed to load config from ${cfgPath}: ${e.message}`);

161 process.exit(1);

162 }

163 }

164 for (const cfgPath of legacyCandidates) {

165 if (!fs.existsSync(cfgPath))

166 continue;

167 warn(`Found ${path.basename(cfgPath)} — this name is deprecated. ` +

168 `Please rename it to slintorm.config.${cfgPath.split(".").pop()}.`);

169 if (cfgPath.endsWith(".json")) {

170 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

171 }

172 try {

173 const mod = await import(pathToFileURL(cfgPath).href);

Lines 439-479javascript

439 if (m) {

440 try {

441 await db.collection(m[1]).drop();

442 }

443 catch {

444 // collection may not exist — non-fatal

445 }

446 }

447 return { rows: [] };

Lines 921-961javascript

921 await exec(`DROP TABLE IF EXISTS "${tableName}"`);

922 await exec(`DELETE FROM "${MIGRATIONS_TABLE}" WHERE name = ${isPg ? "$1" : "?"}`, [name]);

923 removeMigrationRecord(cfg.dir ?? "src", name);

924 rolledBack++;

Source & flagged code

3 flagged · loading source

dist/src/bin/cli.jsView file

459// creates a unique index on `name` in the migrations collection. L460: await exec(`CREATE TABLE "${MIGRATIONS_TABLE}"`); L461: return;

High

Child Process

Package source references child process execution.

dist/src/bin/cli.jsView on unpkg · L459

941warn(`No schema snapshot found for batch ${targetBatch}; cannot rebuild previous tables automatically.`); L942: warn("Update your source files to match that point in history, then re-run `npx slintorm migrate`."); L943: } ... L953: await migrator.ensureTable(unit.tableName, modelDef.fields, modelDef.relations ?? []); L954: await exec(`INSERT INTO "${MIGRATIONS_TABLE}" (name, batch) VALUES (${isPg ? "$1,$2" : "?,?"})`, [unit.name, targetBatch]); L955: writeMigrationRecord(cfg.dir ?? "src", unit, targetBatch, modelDef);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/bin/cli.jsView on unpkg · L941

153try { L154: const mod = await import(pathToFileURL(cfgPath).href); L155: const cfg = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/bin/cli.jsView on unpkg · L153

Findings

3 High4 Medium5 Low

HighChild Processdist/src/bin/cli.js

HighShell

HighRuntime Package Installdist/src/bin/cli.js

MediumDynamic Requiredist/src/bin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/src/bin/cli.jsView file

Lines 133-173javascript

133 path.join(cwd, "slintorm.config.js"),

134 path.join(cwd, "slintorm.config.mjs"),

135 path.join(cwd, "slintorm.config.cjs"),

136 path.join(cwd, "slintorm.config.ts"),

137 path.join(cwd, "slintorm.config.json"),

138 ];

139 const legacyCandidates = [

140 path.join(cwd, "orm.config.js"),

141 path.join(cwd, "orm.config.mjs"),

142 path.join(cwd, "orm.config.cjs"),

143 path.join(cwd, "orm.config.ts"),

144 path.join(cwd, "orm.config.json"),

145 ];

146 for (const cfgPath of primaryCandidates) {

147 if (!fs.existsSync(cfgPath))

148 continue;

149 info(`Loading config: ${path.basename(cfgPath)}`);

150 if (cfgPath.endsWith(".json")) {

151 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

152 }

153 try {

154 const mod = await import(pathToFileURL(cfgPath).href);

155 const cfg = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/bin/cli.jsView on unpkg · L153

156 if (cfg && typeof cfg === "object")

157 return cfg;

158 }

159 catch (e) {

160 fail(`Failed to load config from ${cfgPath}: ${e.message}`);

161 process.exit(1);

162 }

163 }

164 for (const cfgPath of legacyCandidates) {

165 if (!fs.existsSync(cfgPath))

166 continue;

167 warn(`Found ${path.basename(cfgPath)} — this name is deprecated. ` +

168 `Please rename it to slintorm.config.${cfgPath.split(".").pop()}.`);

169 if (cfgPath.endsWith(".json")) {

170 return JSON.parse(fs.readFileSync(cfgPath, "utf8"));

171 }

172 try {

173 const mod = await import(pathToFileURL(cfgPath).href);

Lines 439-479javascript

439 if (m) {

440 try {

441 await db.collection(m[1]).drop();

442 }

443 catch {

444 // collection may not exist — non-fatal

445 }

446 }

447 return { rows: [] };

Lines 921-961javascript

921 await exec(`DROP TABLE IF EXISTS "${tableName}"`);

922 await exec(`DELETE FROM "${MIGRATIONS_TABLE}" WHERE name = ${isPg ? "$1" : "?"}`, [name]);

923 removeMigrationRecord(cfg.dir ?? "src", name);

924 rolledBack++;