ts-prorm-orm@2.2.0
A TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe ordinary login flow discloses the supplied dashboard token to a package-selected default host that differs from the dashboard host named in the CLI’s own example. This is concrete credential disclosure, not an install-time behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI login command without configuring a different API URL.
Impact
The default recipient can receive the dashboard access token.
Mechanism
The login flow submits the token to the identity endpoint; the API client sends it in a Bearer authorization header to the default host.
Attack narrative
When a user logs in without an API override, the CLI uses docs-next-alpha.vercel.app as its default API host. The login completion flow sends the supplied dashboard token to that host in a Bearer authorization header. The package’s login example instead names app.prorm.dev as the dashboard host, and the source contains no recipient-specific confirmation or host binding for the default transfer.
AI rationale
The ordinary login flow discloses the supplied dashboard token to a package-selected default host that differs from the dashboard host named in the CLI’s own example. This is concrete credential disclosure, not an install-time behavior.
Evidence
package.jsondist/cli.jsdist/cli/commands/auth.jsdist/cli/cloud.js
Network endpoints1
docs-next-alpha.vercel.app
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes a CLI; running its login command passes a supplied dashboard token into the login completion flow.
- When no API URL is configured, the CLI defaults to docs-next-alpha.vercel.app. Its login examples name app.prorm.dev as the dashboard host.
- The login flow sends the token to the dashboard identity endpoint, and the API client attaches it as a Bearer token to a request built from the configured API URL.
- The package repository is identified as prod-orm, while the login example’s dashboard host differs from the default recipient.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/cli/commands/db.jsView file
62patternName = generic_password
severity = medium
line = 62
Medium
dist/migrations/prormmigration.jsView file
7exports.PrormMigration = void 0;
L8: const query_interface_1 = require("./query-interface");
L9: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/prormmigration.jsView on unpkg · L7dist/cli/io.jsView file
70const stream = fs.createReadStream(filePath);
L71: const res = await fetch(url, {
L72: method: 'PUT',
L73: // Node's fetch (undici) requires duplex for a stream body.
L74: body: stream_1.Readable.toWeb(stream),
L75: duplex: 'half',
...
L87: if (!res.body) {
L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
L89: return;
...
L160: const g = (0, framework_1.getGlobalOptions)();
L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json;
L162: if (!active) {
Findings
3 Critical2 High5 Medium6 Low
CriticalCredential Exfiltrationdist/cli/io.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli/io.js
CriticalPrevious Version Dangerous Deltadist/cli/cloud.js
HighTrigger Reachable Credential Exfiltrationdist/cli/io.js
HighSemantic Analysis Limiteddist/compliance/backup-verification.js#virtual:normalized:round1
MediumSecret Patterndist/cli/commands/db.js
MediumDynamic Requiredist/migrations/prormmigration.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Affected versions and remediation
This report applies to ts-prorm-orm@2.2.0.
See all versions of ts-prorm-orm for other recorded verdicts.
- Avoid installing ts-prorm-orm@2.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.