ts-prorm-orm@4.9.2
Fails in bundled builds (Cloudflare Workers, webpack, Bun.build): 'Module not found in bundle'. Upgrade to 4.9.4.
A TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe evaluator is a package-aligned code generation helper, and the inspected internal caller supplies generated expressions. Its public string input is not validated, however, so callers that pass untrusted data can cause code execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes the exported evaluator with an expression, such as one derived from untrusted input.
Impact
Untrusted expressions passed to this API can run code with the privileges of the calling process.
Mechanism
The evaluator interpolates the expression into a new function and executes it without checking that it contains only generated type expressions.
AI rationale
The evaluator is a package-aligned code generation helper, and the inspected internal caller supplies generated expressions. Its public string input is not validated, however, so callers that pass untrusted data can cause code execution.
Evidence
package.jsondist/codegen/index.jsdist/codegen/type-code.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a code generation entry point.
- That entry point publicly re-exports the type expression evaluator.
- The evaluator inserts its string argument into a new function and runs it without validating the expression.
- The evaluator is documented for generated expressions, and the internal resolver builds its expression from a type descriptor.
Evidence against
- The inspected source shows no automatic invocation of the evaluator with external input; its internal resolver supplies generated type code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/codegen/type-code.jsView file
377function evaluateTypeCode(expr) {
L378: return new Function('DataTypes', `return (${expr});`)(data_types_1.DataTypes);
L379: }
High
dist/schema-types.jsView file
32exports.buildNextSequenceValueSQL = buildNextSequenceValueSQL;
L33: const schema_objects_1 = require("./schema-objects");
L34: const structured_ddl_1 = require("./structured-ddl");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/schema-types.jsView on unpkg · L32dist/cli/core/io.jsView file
70const stream = fs.createReadStream(filePath);
L71: const res = await fetch(url, {
L72: method: 'PUT',
L73: // Node's fetch (undici) requires duplex for a stream body.
L74: body: stream_1.Readable.toWeb(stream),
L75: duplex: 'half',
...
L87: if (!res.body) {
L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
L89: return;
...
L160: const g = (0, framework_1.getGlobalOptions)();
L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json;
L162: if (!active) {
Findings
1 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli/core/io.js
HighEvaldist/codegen/type-code.js
HighSemantic Analysis Limiteddist/audit/aggregation.js#virtual:normalized:round1
MediumDynamic Requiredist/schema-types.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ts-prorm-orm@4.9.2.
See all versions of ts-prorm-orm for other recorded verdicts.
- Review the evidence and your use of ts-prorm-orm@4.9.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.