registry / spindb / 0.61.2

spindb@0.61.2

Zero-config Docker-free local database containers. Create, backup, and clone a variety of popular databases.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 290 file(s), 2.92 MB of source, external domains: 127.0.0.1, api.github.com, clickhouse.com, deb.nodesource.com, dev.mysql.com, github.com, postgresapp.com, qdrant.tech, questdb.io, raw.githubusercontent.com, registry.layerbase.host, registry.npmjs.org, weaviate.io, www.enterprisedb.com, www.mongodb.com, www.sqlite.org

Source & flagged code

5 flagged

dist/core/docker-exporter.jsView file

Lines 346-386javascript

346 userCreationCommands = `

347# Create user with password

348echo "Creating database user..."

349cat > /tmp/create-user.sql <<EOSQL

350CREATE USER IF NOT EXISTS '$SPINDB_USER'@'%' IDENTIFIED BY '$SPINDB_PASSWORD';

351GRANT ALL PRIVILEGES ON \\\`$DATABASE\\\`.* TO '$SPINDB_USER'@'%';

352FLUSH PRIVILEGES;

353EOSQL

354run_as_spindb spindb run "$CONTAINER_NAME" /tmp/create-user.sql --database mysql

355rm -f /tmp/create-user.sql

356`;

357 break;

358 case Engine.MongoDB:

359 case Engine.FerretDB:

360 userCreationCommands = `

361# Create user with password

362echo "Creating database user..."

363cat > /tmp/create-user.js <<EOJS

364db.createUser({

365 user: "$SPINDB_USER",

366 pwd: "$SPINDB_PASSWORD",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/docker-exporter.jsView on unpkg · L366

367 roles: [{ role: "readWrite", db: "$DATABASE" }]

368});

369EOJS

370run_as_spindb spindb run "$CONTAINER_NAME" /tmp/create-user.js --database admin

371rm -f /tmp/create-user.js

372`;

373 break;

374 case Engine.Redis:

375 case Engine.Valkey:

376 // Redis uses requirepass, configured at start time

377 userCreationCommands = `

378# Redis/Valkey authentication is configured at server start via --requirepass

379echo "Authentication configured via server settings"

380`;

381 break;

382 case Engine.ClickHouse:

383 userCreationCommands = `

384# Create user with password

385echo "Creating database user..."

386cat > /tmp/create-user.sql <<EOSQL

dist/core/spawn-utils.jsView file

Lines 1-23javascript

1/**

2 * Shared spawn utilities for executing commands safely

3 *

4 * This module provides a Promise-based wrapper around child_process.spawn

5 * with proper timeout handling and error messages.

High

Child Process

Package source references child process execution.

dist/core/spawn-utils.jsView on unpkg · L3

6 */

7import { spawn } from 'child_process';

8/**

9 * Execute a command using spawn with argument array (safer than shell interpolation)

dist/engines/questdb/index.jsView file

Lines 436-476javascript

436 * Format: postgresql://admin:quest@127.0.0.1:PORT/DATABASE

437 */

438 getConnectionString(container, database) {

439 const { port } = container;

440 const db = database || container.database ||

dist/config/engine-defaults.jsView file

Lines 207-247javascript

207 portRange: { start: 8812, end: 8912 },

208 superuser: 'admin', // Default user with password 'quest'

209 connectionScheme: 'postgresql', // Uses PostgreSQL wire protocol

210 logFileName: 'questdb.log',

211 pidFileName

Source & flagged code

5 flagged · loading source

dist/core/docker-exporter.jsView file

366patternName = generic_password severity = medium line = 366 matchedText = pwd: "$S...RD",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/docker-exporter.jsView on unpkg · L366

dist/core/spawn-utils.jsView file

3* L4: * This module provides a Promise-based wrapper around child_process.spawn L5: * with proper timeout handling and error messages.

High

Child Process

Package source references child process execution.

dist/core/spawn-utils.jsView on unpkg · L3

65/** L66: * Escape a string for use in a PowerShell single-quoted string. L67: * PowerShell escapes single quotes by doubling them: ' becomes ''

High

Shell

Package source references shell execution.

dist/core/spawn-utils.jsView on unpkg · L65

dist/engines/questdb/index.jsView file

456throw new Error('psql not found. Install PostgreSQL client tools or use the Web Console at ' + L457: `http://127.0.0.1:${port + 188}`); L458: } ... L461: stdio: 'inherit', L462: env: { ...process.env, PGPASSWORD: auth.password }, L463: }; L464: return new Promise((resolve, reject) => { L465: const proc = spawn(psqlPath, ['-h', '127.0.0.1', '-p', String(port), '-U', auth.user, '-d', db], spawnOptions); L466: proc.on('error', reject);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/engines/questdb/index.jsView on unpkg · L456

dist/config/engine-defaults.jsView file

227patternName = generic_password severity = medium line = 227 matchedText = superuse...rd')

Medium

Secret Pattern

Hardcoded password in dist/config/engine-defaults.js

dist/config/engine-defaults.jsView on unpkg · L227

Findings

3 High6 Medium5 Low

HighChild Processdist/core/spawn-utils.js

HighShelldist/core/spawn-utils.js

HighSame File Env Network Executiondist/engines/questdb/index.js

MediumSecret Patterndist/core/docker-exporter.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/config/engine-defaults.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/core/docker-exporter.jsView file

Lines 346-386javascript

346 userCreationCommands = `

347# Create user with password

348echo "Creating database user..."

349cat > /tmp/create-user.sql <<EOSQL

350CREATE USER IF NOT EXISTS '$SPINDB_USER'@'%' IDENTIFIED BY '$SPINDB_PASSWORD';

351GRANT ALL PRIVILEGES ON \\\`$DATABASE\\\`.* TO '$SPINDB_USER'@'%';

352FLUSH PRIVILEGES;

353EOSQL

354run_as_spindb spindb run "$CONTAINER_NAME" /tmp/create-user.sql --database mysql

355rm -f /tmp/create-user.sql

356`;

357 break;

358 case Engine.MongoDB:

359 case Engine.FerretDB:

360 userCreationCommands = `

361# Create user with password

362echo "Creating database user..."

363cat > /tmp/create-user.js <<EOJS

364db.createUser({

365 user: "$SPINDB_USER",

366 pwd: "$SPINDB_PASSWORD",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/docker-exporter.jsView on unpkg · L366

367 roles: [{ role: "readWrite", db: "$DATABASE" }]

368});

369EOJS

370run_as_spindb spindb run "$CONTAINER_NAME" /tmp/create-user.js --database admin

371rm -f /tmp/create-user.js

372`;

373 break;

374 case Engine.Redis:

375 case Engine.Valkey:

376 // Redis uses requirepass, configured at start time

377 userCreationCommands = `

378# Redis/Valkey authentication is configured at server start via --requirepass

379echo "Authentication configured via server settings"

380`;

381 break;

382 case Engine.ClickHouse:

383 userCreationCommands = `

384# Create user with password

385echo "Creating database user..."

386cat > /tmp/create-user.sql <<EOSQL

dist/core/spawn-utils.jsView file

Lines 1-23javascript

1/**

2 * Shared spawn utilities for executing commands safely

3 *

4 * This module provides a Promise-based wrapper around child_process.spawn

5 * with proper timeout handling and error messages.

High

Child Process

Package source references child process execution.

dist/core/spawn-utils.jsView on unpkg · L3

6 */

7import { spawn } from 'child_process';

8/**

9 * Execute a command using spawn with argument array (safer than shell interpolation)

dist/engines/questdb/index.jsView file

Lines 436-476javascript

436 * Format: postgresql://admin:quest@127.0.0.1:PORT/DATABASE

437 */

438 getConnectionString(container, database) {

439 const { port } = container;

440 const db = database || container.database ||

dist/config/engine-defaults.jsView file

Lines 207-247javascript

207 portRange: { start: 8812, end: 8912 },

208 superuser: 'admin', // Default user with password 'quest'

209 connectionScheme: 'postgresql', // Uses PostgreSQL wire protocol

210 logFileName: 'questdb.log',

211 pidFileName

Lines 45-85javascript

45 });

46 proc.on('close', (code) => {

47 cleanup();

48 if (timedOut)

49 return; // Already rejected by timeout

50 if (code === 0) {

51 resolve({ stdout, stderr });

52 }

53 else {

54 reject(new Error(`Command "${command} ${args.join(' ')}" failed with code ${code}: ${stderr || stdout}`));

55 }

56 });

57 proc.on('error', (err) => {

58 cleanup();

59 if (timedOut)

60 return; // Already rejected by timeout

61 reject(new Error(`Failed to execute "${command}": ${err.message}`));

62 });

63 });

64}

65/**

66 * Escape a string for use in a PowerShell single-quoted string.

67 * PowerShell escapes single quotes by doubling them: ' becomes ''

High

Shell

Package source references shell execution.

dist/core/spawn-utils.jsView on unpkg · L65

68 */

69function escapeForPowerShell(s) {

70 return s.replace(/'/g, "''");

71}

72/**

73 * Extract a ZIP archive using PowerShell Expand-Archive (Windows)

74 *

75 * @param zipFile - Path to the ZIP file

76 * @param destDir - Destination directory for extraction

77 * @throws Error if extraction fails

78 */

79export async function extractWindowsArchive(zipFile, destDir) {

80 // Escape paths to prevent command injection via single quotes

81 // Use -LiteralPath to treat the path literally (no wildcard expansion)

82 const safeZipFile = escapeForPowerShell(zipFile);

83 const safeDestDir = escapeForPowerShell(destDir);

84 await spawnAsync('powershell', [

85 '-NoProfile',