Loading npm security reports…

supabase-test@2.19.3: Suspicious npm security report (Warn) | LPM Firewall

registry / supabase-test / 2.19.3

supabase-test@2.19.3

supabase-test offers isolated, role-aware, and rollback-friendly PostgreSQL environments for integration tests with Supabase defaults baked in

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 7.70 KB of source

Source & flagged code

4 flagged

esm/connect.jsView file

Lines 1-47javascript

1import deepmerge from 'deepmerge';

2import { getPgEnvVars } from 'pg-env';

3import { getConnections as getPgConnections } from 'pgsql-test';

4/**

5 * Supabase default connection options

6 */

7const SUPABASE_DEFAULTS = {

8 roles: {

9 anonymous: 'anon',

10 authenticated: 'authenticated',

11 administrator: 'service_role',

12 default: 'anon',

13 },

14 connections: {

15 app: {

16 user: 'supabase_admin',

17 password: 'postgres',

Medium

Secret Pattern

Package contains a possible secret pattern.

esm/connect.jsView on unpkg · L17

18 }

19 }

20};

21/**

22 * Supabase default PostgreSQL config

23 */

24const SUPABASE_PG_DEFAULTS = {

25 port: 54322,

26 user: 'supabase_admin',

27 password: 'postgres',

Medium

Secret Pattern

Hardcoded password in esm/connect.js

esm/connect.jsView on unpkg · L27

28};

29/**

30 * Get connections with Supabase defaults applied.

31 * Uses deepmerge for proper nested config merging.

32 *

33 * Precedence (later wins):

34 * 1. Supabase defaults

35 * 2. Environment variables (PGUSER/PGPASSWORD)

36 * 3. User-provided options

37 */

38export const getConnections = async (cn = {}, seedAdapters) => {

39 // Get environment variables (only includes defined keys)

40 const pgEnvVars = getPgEnvVars();

41 // Build env overrides - pgEnvVars already only has defined keys

42 // Mirror user/password to connections.app for the app connection

43 const envOverrides = {

44 pg: pgEnvVars,

45 db: {

46 connections: {

47 app: {

connect.jsView file

Lines 3-53javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.getConnections =

Source & flagged code

4 flagged · loading source

esm/connect.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...es',

Medium

Secret Pattern

Package contains a possible secret pattern.

esm/connect.jsView on unpkg · L17

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code