registry / supabase-test / 2.19.0

supabase-test@2.19.0

supabase-test offers isolated, role-aware, and rollback-friendly PostgreSQL environments for integration tests with Supabase defaults baked in

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 7.70 KB of source

Source & flagged code

4 flagged

esm/connect.jsView file

Lines 1-47javascript

1import deepmerge from 'deepmerge';

2import { getPgEnvVars } from 'pg-env';

3import { getConnections as getPgConnections } from 'pgsql-test';

4/**

5 * Supabase default connection options

6 */

Source & flagged code

4 flagged · loading source

esm/connect.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...es',

Medium

Secret Pattern

Package contains a possible secret pattern.

esm/connect.jsView on unpkg · L17

27patternName = generic_password severity = medium line = 27 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in esm/connect.js

esm/connect.jsView on unpkg · L27

connect.jsView file

23patternName = generic_password severity = medium line = 23 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L23

33patternName = generic_password severity = medium line = 33 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L33

Findings

4 Medium1 Low

MediumSecret Patternesm/connect.js

MediumSecret Patternconnect.js

LowScripts Present

connect.jsView file

Lines 3-53javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.getConnections = void 0;

7const deepmerge_1 = __importDefault(require("deepmerge"));

8const pg_env_1 = require("pg-env");

9const pgsql_test_1 = require("pgsql-test");

10/**

11 * Supabase default connection options

12 */

13const SUPABASE_DEFAULTS = {

14 roles: {

15 anonymous: 'anon',

16 authenticated: 'authenticated',

17 administrator: 'service_role',

18 default: 'anon',

19 },

20 connections: {

21 app: {

22 user: 'supabase_admin',

23 password: 'postgres',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L23

24 }

25 }

26};

27/**

28 * Supabase default PostgreSQL config

29 */

30const SUPABASE_PG_DEFAULTS = {

31 port: 54322,

32 user: 'supabase_admin',

33 password: 'postgres',

Medium

Secret Pattern

Hardcoded password in connect.js

connect.jsView on unpkg · L33

34};

35/**

36 * Get connections with Supabase defaults applied.

37 * Uses deepmerge for proper nested config merging.

38 *

39 * Precedence (later wins):

40 * 1. Supabase defaults

41 * 2. Environment variables (PGUSER/PGPASSWORD)

42 * 3. User-provided options

43 */

44const getConnections = async (cn = {}, seedAdapters) => {

45 // Get environment variables (only includes defined keys)

46 const pgEnvVars = (0, pg_env_1.getPgEnvVars)();

47 // Build env overrides - pgEnvVars already only has defined keys

48 // Mirror user/password to connections.app for the app connection

49 const envOverrides = {

50 pg: pgEnvVars,

51 db: {

52 connections: {

53 app: {