ts-prorm-orm@1.1.0

A TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 306 file(s), 5.59 MB of source, external domains: api.cloudflare.com, api.sumologic.com, bucket.s3.amazonaws.com, clickhouse.com, dev.mysql.com, docs.aws.amazon.com, docs.oracle.com, docs.snowflake.com, docs.timescale.com, github.com, hypopg.readthedocs.io, learn.microsoft.com, mariadb.com, papertrailapp.com, pgrouting.org, postgis.net, www.ibm.com, www.postgresql.org, www.sqlite.org, www.w3.org

Source & flagged code

7 flagged

dist/nosql/redis/index.jsView file

Lines 389-429javascript

389 const args = ['GROUP', groupName, consumerName];

390 if (options.count !== undefined)

391 args.push('COUNT', options.count);

392 if (options.block !== undefined)

393 args.push('BLOCK', options.block);

394 args.push('STREAMS', ...keys, ...ids);

395 const raw = (await c.xreadgroup(...args));

396 return toStreamReadResults(raw);

397 }, 'XREADGROUP');

398 }

399 /** `XACK` - acknowledge that a consumer group has finished processing the given entry IDs. */

400 async xack(key, groupName, ids) {

401 return this.exec((c) => c.xack(key, groupName, ...ids), 'XACK');

402 }

403 // ---------------------------------------------------------------------

404 // Scripting (Lua)

405 // ---------------------------------------------------------------------

406 /**

407 * `EVAL` - run a Lua `script` server-side, atomically. `keys` are passed

408 * as Redis's `KEYS[1..N]` (and count toward the `numkeys` argument),

409 * `args` as `ARGV[1..N]`. Prefer `evalsha()` once a script has been

410 * cached (via `scriptLoad()` or a prior `eval()`) to avoid resending the

411 * source on every call.

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/nosql/redis/index.jsView on unpkg · L409

412 */

413 async eval(script, keys = [], args = []) {

414 return this.exec((c) => c.eval(script, keys.length, ...keys, ...args), 'EVAL');

415 }

416 /**

417 * `EVALSHA` - run a previously cached Lua script by its SHA1 digest

418 * (see `scriptLoad()`), avoiding the cost of resending the script body.

419 * Redis replies with a `NOSCRIPT` error (surfaced here as a

420 * `DatabaseError`) if the script isn't cached on the server.

421 */

422 async evalsha(sha1, keys = [], args = []) {

423 return this.exec((c) => c.evalsha(sha1, keys.length, ...keys, ...args), 'EVALSHA');

424 }

425 /**

426 * `SCRIPT LOAD` - cache a Lua script on the server without executing it,

427 * returning its SHA1 digest for later `evalsha()` calls.

428 */

429 async scriptLoad(script) {

dist/migrations/prormmigration.jsView file

Lines 1-27javascript

1"use strict";

2/**

3 * PrormMigration class - Integration layer between migrations and Prorm

4 * Handles running migrations with the Prorm instance

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.PrormMigration =

README.mdView file

Lines 264-304markdown

264

265// Upsert (INSERT OR REPLACE)

266await User.upsert({

267 id: 1,

268 name: 'John',

269 email: 'john@example.com'

270});

271```

272

273### MySQL

274

275```typescript

276import { Prorm, DataTypes } from 'ts-prorm-orm';

Source & flagged code

7 flagged · loading source

dist/nosql/redis/index.jsView file

409* `args` as `ARGV[1..N]`. Prefer `evalsha()` once a script has been L410: * cached (via `scriptLoad()` or a prior `eval()`) to avoid resending the L411: * source on every call.

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/nosql/redis/index.jsView on unpkg · L409

dist/migrations/prormmigration.jsView file

7exports.PrormMigration = void 0; L8: const query_interface_1 = require("./query-interface"); L9: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/migrations/prormmigration.jsView on unpkg · L7

README.mdView file

284patternName = generic_password severity = medium line = 284 matchedText = password...rd',

Findings

9 Medium6 Low

MediumDynamic Requiredist/migrations/prormmigration.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/nosql/redis/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ts-prorm-orm@1.1.0.

See all versions of ts-prorm-orm for other recorded verdicts.

Review the evidence and your use of ts-prorm-orm@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-09 11:35:02.881Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.