registry / ts-prorm-orm / 4.8.2
ts-prorm-orm@4.8.2
⚠ Under reviewA TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe inspected files do not establish malicious behavior, and the flagged file transfer is a user-invoked helper that streams a chosen file to its supplied URL. A clean verdict requires citations for more distinct paths than the citation limit allows, so the package cannot be certified clean in this review.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The reviewed transfer and authentication behavior runs when users invoke the corresponding CLI operations.
Impact
No confirmed attack impact was established from the inspected source.
Mechanism
File transfer uses a caller-supplied URL; passwordless requests carry a signed grant scoped to the requested operation and table.
AI rationale
The inspected files do not establish malicious behavior, and the flagged file transfer is a user-invoked helper that streams a chosen file to its supplied URL. A clean verdict requires citations for more distinct paths than the citation limit allows, so the package cannot be certified clean in this review.
Evidence
package.jsondist/cli/core/io.jsdist/cli/core/cloud.jsdist/cli/basic/commands/passwordless.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json limits its lifecycle hooks to build and package checks under prepublishOnly and husky under prepare.
- dist/cli/core/io.js uploads the caller-selected local file to the supplied URL; this code does not read credential or environment data.
- dist/cli/core/cloud.js derives the API from PRORM_API_URL or the package host and sends bearer tokens only when authentication is enabled.
- dist/cli/basic/commands/passwordless.js creates a signed grant limited to the requested operation and table.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcedist/schema-types.jsView file
31exports.buildNextSequenceValueSQL = buildNextSequenceValueSQL;
L32: const schema_objects_1 = require("./schema-objects");
L33: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/schema-types.jsView on unpkg · L31dist/cli/core/io.jsView file
70const stream = fs.createReadStream(filePath);
L71: const res = await fetch(url, {
L72: method: 'PUT',
L73: // Node's fetch (undici) requires duplex for a stream body.
L74: body: stream_1.Readable.toWeb(stream),
L75: duplex: 'half',
...
L87: if (!res.body) {
L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
L89: return;
...
L160: const g = (0, framework_1.getGlobalOptions)();
L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json;
L162: if (!active) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli/core/io.jsView on unpkg · L70dist/compliance/backup-verification.js#virtual:normalized:round1
Findings
1 Critical1 High4 Medium6 Low
CriticalCredential Exfiltrationdist/cli/core/io.js
HighSemantic Analysis Limiteddist/compliance/backup-verification.js#virtual:normalized:round1
MediumDynamic Requiredist/schema-types.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ts-prorm-orm@4.8.2.
See all versions of ts-prorm-orm for other recorded verdicts.
- Review the evidence and your use of ts-prorm-orm@4.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.