registry / supalite / 0.10.0

supalite@0.10.0

A lightweight TypeScript PostgreSQL client with Supabase-style API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 247 KB of source, external domains: github.com, oqoq.ai, www.postgresql.org

Source & flagged code

7 flagged

dist/postgres-client.jsView file

Lines 255-295javascript

255 }

256 }

257 catch (err) {

258 console.error('[SupaLite ERROR] Database connection error:', err.message);

259 throw new Error(`Failed to establish database connection: ${err.message}`);

260 }

261 }

262 else {

263 // 기존 코드: 개별 매개변수 사용

264 poolConfigOptions = {

265 user: config?.user || process.env.DB_USER,

266 host: config?.host || process.env.DB_HOST,

267 database: config?.database || process.env.DB_NAME,

268 password: config?.password || process.env.DB_PASS,

269 port: config?.port || Number(process.env.DB_PORT) || 5432,

270 ssl: config?.ssl !== undefined ? config.ssl : process.env.DB_SSL === 'true', // ssl 설정 명시적 처리

271 };

272 if (this.verbose) {

273 console.log('[SupaLite VERBOSE] Database connection using individual parameters:', {

274 ...poolConfigOptions,

275 password: '********'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/postgres-client.jsView on unpkg · L275

276 });

277 }

278 }

279 this.pool = new pg_1.Pool(poolConfigOptions);

280 }

281 // Error handling — only manage listeners on a pool we own. For an external

282 // pool (ownsPool=false) the caller owns its lifecycle and error handling;

283 // attaching here would leak a listener per constructed/forked client.

284 if (this.ownsPool) {

285 this.pool.on('error', (err) => {

286 console.error('[SupaLite ERROR] Unexpected error on idle client', err);

287 });

288 }

289 }

290 /**

291 * @deprecated Manual transaction control mutates this instance and is NOT

292 * concurrency-safe. Use `transaction(cb)` instead.

293 */

294 // 트랜잭션 시작

295 async begin() {

dist/gen-types.jsView file

Lines 1112-1152javascript

1112 const key = formatKey(name, style);

1113 if (values.length <= 2) {

1114 lines.push(`${pad(3)}${key}: ${renderStringArrayLiteral(values, style)}${

dist/client.jsView file

Lines 1-29javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

README.mdView file

Lines 199-239markdown

199```

200

201```bash

202supalite gen types --help

203```

204

205You can also use `npx supalite ...` without a global install.

206

207## Type System

208

209### Database schema definition

210

211```typescript

212// Database types generated by SupaLite CLI

README.ko.mdView file

Lines 198-238markdown

198```

199

200```bash

201supalite gen types --help

202```

203

204전역 설치 없이 `npx supalite ...`로도 사용 가능합니다.

205

206## 타입 시스템

207

208### 데이터베이스 스키마 정의

209

210```typescript

211// SupaLite CLI의 타입 생성기로 생성된 데이터베이스 타입 정의

Source & flagged code

7 flagged · loading source

dist/postgres-client.jsView file

275patternName = generic_password severity = medium line = 275 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/postgres-client.jsView on unpkg · L275

dist/gen-types.jsView file

1132// Prettier is ESM-only; keep a real dynamic import in the CJS output. L1133: const importer = new Function('specifier', 'return import(specifier)'); L1134: prettierPromise = importer('prettier');

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/gen-types.jsView on unpkg · L1132

dist/client.jsView file

17exports.SupaLitePG = exports.SupaliteClient = void 0; L18: const postgres_client_1 = require("./postgres-client"); L19: class SupaliteClient extends postgres_client_1.SupaLitePG {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L17

README.mdView file

219patternName = generic_password severity = medium line = 219 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L219

313patternName = generic_password severity = medium line = 313 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L313

README.ko.mdView file

218patternName = generic_password severity = medium line = 218 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.ko.md

README.ko.mdView on unpkg · L218

313patternName = generic_password severity = medium line = 313 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.ko.md

README.ko.mdView on unpkg · L313

Findings

9 Medium6 Low

MediumSecret Patterndist/postgres-client.js

MediumDynamic Requiredist/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

MediumSecret PatternREADME.ko.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/gen-types.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/postgres-client.jsView file

Lines 255-295javascript

255 }

256 }

257 catch (err) {

258 console.error('[SupaLite ERROR] Database connection error:', err.message);

259 throw new Error(`Failed to establish database connection: ${err.message}`);

260 }

261 }

262 else {

263 // 기존 코드: 개별 매개변수 사용

264 poolConfigOptions = {

265 user: config?.user || process.env.DB_USER,

266 host: config?.host || process.env.DB_HOST,

267 database: config?.database || process.env.DB_NAME,

268 password: config?.password || process.env.DB_PASS,

269 port: config?.port || Number(process.env.DB_PORT) || 5432,

270 ssl: config?.ssl !== undefined ? config.ssl : process.env.DB_SSL === 'true', // ssl 설정 명시적 처리

271 };

272 if (this.verbose) {

273 console.log('[SupaLite VERBOSE] Database connection using individual parameters:', {

274 ...poolConfigOptions,

275 password: '********'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/postgres-client.jsView on unpkg · L275

276 });

277 }

278 }

279 this.pool = new pg_1.Pool(poolConfigOptions);

280 }

281 // Error handling — only manage listeners on a pool we own. For an external

282 // pool (ownsPool=false) the caller owns its lifecycle and error handling;

283 // attaching here would leak a listener per constructed/forked client.

284 if (this.ownsPool) {

285 this.pool.on('error', (err) => {

286 console.error('[SupaLite ERROR] Unexpected error on idle client', err);

287 });

288 }

289 }

290 /**

291 * @deprecated Manual transaction control mutates this instance and is NOT

292 * concurrency-safe. Use `transaction(cb)` instead.

293 */

294 // 트랜잭션 시작

295 async begin() {

dist/gen-types.jsView file

Lines 1112-1152javascript

1112 const key = formatKey(name, style);

1113 if (values.length <= 2) {

1114 lines.push(`${pad(3)}${key}: ${renderStringArrayLiteral(values, style)}${

dist/client.jsView file

Lines 1-29javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

README.mdView file

Lines 199-239markdown

199```

200

201```bash

202supalite gen types --help

203```

204

205You can also use `npx supalite ...` without a global install.

206

207## Type System

208

209### Database schema definition

210

211```typescript

212// Database types generated by SupaLite CLI

README.ko.mdView file

Lines 198-238markdown

198```

199

200```bash

201supalite gen types --help

202```

203

204전역 설치 없이 `npx supalite ...`로도 사용 가능합니다.

205

206## 타입 시스템

207

208### 데이터베이스 스키마 정의

209

210```typescript

211// SupaLite CLI의 타입 생성기로 생성된 데이터베이스 타입 정의

Lines 293-333markdown

293- `Functions` always lists detected function names; signatures are included by default

294- `--type-case` controls enum/composite type key casing (`preserve` | `snake` | `camel` | `pascal`)

295- `--function-case` controls function key casing (`preserve` | `snake` | `camel` | `pascal`)

296- `--dump-functions-sql [path]` writes `CREATE FUNCTION/PROCEDURE` definitions (from `pg_get_functiondef`) to a local file

297- Use `--schema public` to exclude test/dev schemas from generated types

298- Uses `DB_CONNECTION` if `--db-url` is omitted

299

300Roadmap

301- TODO (AI): generate transactional TypeScript wrappers for RPC/functions from schema metadata

302

303## Usage Examples

304

305### Database connection

306

307```typescript

308import { SupaLitePG } from 'supalite';

309import { Database } from './types/database';

310

311const client = new SupaLitePG<Database>({

312 user: 'testuser',

313 password: 'testpassword',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L313

314 host: 'localhost',

315 database: 'testdb',

316 port: 5432,

317 ssl: false,

318 // bigintTransform: 'number-or-string', // default: 'number-or-string'

319 // verbose: true

320});

321```

322

323```typescript

324import { SupaliteClient } from 'supalite';

325import { Database } from './types/database';

326

327// SupaliteClient is a thin wrapper around SupaLitePG.

328const client = new SupaliteClient<Database>({

329 connectionString: process.env.DB_CONNECTION || 'postgresql://user:pass@localhost:5432/db',

330});

331```

332

333```typescript

Lines 293-333markdown

293- `--type-case`는 enum/composite 타입 키의 케이스를 제어합니다 (`preserve` | `snake` | `camel` | `pascal`)

294- `--function-case`는 함수 키의 케이스를 제어합니다 (`preserve` | `snake` | `camel` | `pascal`)

295- `--dump-functions-sql [path]`는 `pg_get_functiondef` 기반의 `CREATE FUNCTION/PROCEDURE` 정의를 로컬 파일로 저장합니다.

296- 테스트/개발용 스키마를 제외하려면 `--schema public`을 사용하세요.

297- `--db-url`을 생략하면 `DB_CONNECTION`을 사용합니다.

298

299로드맵

300- TODO (AI): 스키마 메타데이터 기반 RPC/함수용 트랜잭션 TypeScript 래퍼 자동 생성

301

302## 사용 예시

303

304### 데이터베이스 연결

305

306```typescript

307import { SupaLitePG } from 'supalite';

308import { Database } from './types/database';

309

310// 타입이 적용된 클라이언트 생성

311const client = new SupaLitePG<Database>({

312 user: 'testuser',

313 password: 'testpassword',

Medium

Secret Pattern

Hardcoded password in README.ko.md

README.ko.mdView on unpkg · L313

314 host: 'localhost',

315 database: 'testdb',

316 port: 5432,

317 ssl: false,

318 // bigintTransform: 'number-or-string', // 안전 범위는 Number, 그 외는 문자열 (기본값: 'number-or-string')

319 // verbose: true // 상세 로그 출력

320});

321```

322

323```typescript

324import { SupaliteClient } from 'supalite';

325import { Database } from './types/database';

326

327// SupaliteClient는 SupaLitePG의 얇은 래퍼입니다.

328const client = new SupaliteClient<Database>({

329 connectionString: process.env.DB_CONNECTION || 'postgresql://user:pass@localhost:5432/db',

330});

331```

332

333```typescript