registry / ts-prorm-orm / 4.6.3
ts-prorm-orm@4.6.3
⚠ Under reviewA TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more
AI Security Review
scanned 21h ago · by lpm-firewall-aiThe inspected source does not substantiate the scanner’s credential-exfiltration claim, and the manifest shows ordinary preparation and prepublication commands. The required clean citation coverage exceeds the 256-citation limit, so the full package cannot be cleared from this review.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes the file upload helper.
Impact
The excerpts do not establish credential theft or another attack; the broader source review remains incomplete.
Mechanism
The helper streams the named local file in a PUT request to the supplied URL.
AI rationale
The inspected source does not substantiate the scanner’s credential-exfiltration claim, and the manifest shows ordinary preparation and prepublication commands. The required clean citation coverage exceeds the 256-citation limit, so the full package cannot be cleared from this review.
Decision evidence
public snapshotAI called this Manual Review at 74.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines prepare as Husky setup and prepublishOnly as build, package checks, and tests.
- The flagged helper streams the explicitly supplied local file to an explicitly supplied URL; this excerpt does not establish credential harvesting.
- The CLI attaches a bearer token only when its request is authenticated and a token is present.
Evidence against
- The inspected source does not establish a malicious transfer or install-time attack.
- The required clean review covers more distinct paths than the citation limit permits.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcedist/schema-types.jsView file
31exports.buildNextSequenceValueSQL = buildNextSequenceValueSQL;
L32: const schema_objects_1 = require("./schema-objects");
L33: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/schema-types.jsView on unpkg · L31dist/cli/core/io.jsView file
70const stream = fs.createReadStream(filePath);
L71: const res = await fetch(url, {
L72: method: 'PUT',
L73: // Node's fetch (undici) requires duplex for a stream body.
L74: body: stream_1.Readable.toWeb(stream),
L75: duplex: 'half',
...
L87: if (!res.body) {
L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
L89: return;
...
L160: const g = (0, framework_1.getGlobalOptions)();
L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json;
L162: if (!active) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli/core/io.jsView on unpkg · L70dist/compliance/backup-verification.js#virtual:normalized:round1
Findings
1 Critical1 High4 Medium6 Low
CriticalCredential Exfiltrationdist/cli/core/io.js
HighSemantic Analysis Limiteddist/compliance/backup-verification.js#virtual:normalized:round1
MediumDynamic Requiredist/schema-types.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ts-prorm-orm@4.6.3.
See all versions of ts-prorm-orm for other recorded verdicts.
- Review the evidence and your use of ts-prorm-orm@4.6.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.