ts-prorm-orm@4.9.4

⚠ Under review

A TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The inspected source does not substantiate the scanner's credential-exfiltration claim: the flagged helper performs a general presigned file transfer. The required clean citation coverage exceeds the available limit, so the remaining package behavior is unresolved.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Unresolved; the inspected helper would run when called by package code.

Impact

No confirmed credential disclosure or other attack impact; broader package behavior remains unreviewed.

Mechanism

The helper streams a local file to the supplied URL, with no credential collection shown in the inspected excerpt.

AI rationale

Evidence

dist/cli/core/io.js

Decision evidence

public snapshot

AI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.

AI review observations

The inspected manifest excerpt shows prepare and prepublishOnly scripts, not an install-time hook.
The flagged upload helper sends a caller-provided file to a presigned URL; this excerpt does not show credential or environment harvesting.
The package entrypoint exports CLI model-generator functions, but the inspected source does not establish a caller for the upload helper.

Evidence against

The scanner labels the helper as credential exfiltration, but the inspected code shows a general file-transfer helper and does not establish that credentials are collected or sent.
The required clean review covers more source paths than the citation limit permits, so the package cannot be cleared from this bounded inspection.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

4 flagged

dist/codegen/type-code.jsView file

Lines 357-397javascript

357 case 'VECTOR':

358 return 'number[]';

359 case 'ARRAY':

360 case 'LIST': {

361 const el = descriptorToTsType(d.element);

362 return /^[\w.]+$/.test(el) ? `${el}[]` : `Array<${el}>`;

363 }

364 case 'HSTORE':

365 return 'Record<string, string | null>';

366 default:

367 return 'unknown';

368 }

369}

370/**

371 * Evaluate generated type code into the `DataType` it builds.

372 *

373 * The expression is generator output — `DataTypes` calls whose every argument

374 * went through {@link tsString} or a number check — so no catalog text is

375 * evaluated as code.

376 */

377function evaluateTypeCode(expr) {

378 return new Function('DataTypes', `return (${expr});`)(data_types_1.DataTypes);

379}

High

Eval

Package source references dynamic code evaluation.

dist/codegen/type-code.jsView on unpkg · L377

380/**

381 * The type code for a column read from `dialect`: the portable

382 * `DataTypes.X(...)` call when `dialect` recreates the same column from it,

383 * else the native type verbatim.

384 *

385 * "The same column" is checked, not assumed: the portable type is rendered

386 * with the dialect's own `getDataTypeSql()` and mapped back with its

387 * `mapNativeType()`. When the engine cannot create the type (SQLite has no

388 * BIT), or creates a different one (CockroachDB's `INTEGER` is 64-bit; legacy

389 * type mapping widens some types), the native string is kept so `sync()`

390 * recreates exactly the column that was read.

391 */

392function resolveTypeCode(descriptor, options) {

393 const code = descriptorToCode(descriptor, {

394 nativeType: options.nativeType,

395 nativeBase: (0, type_normalize_1.parseNativeType)(options.nativeType).base,

396 dataTypes: options.dataTypes,

397 });

dist/schema-types.jsView file

Lines 12-52javascript

12 *

13 * Values reaching SQL here are literals, not identifiers: an enum's members, a

14 * comment's text, a domain's default. Each goes through {@link quoteLiteral}

15 * rather than being interpolated.

16 */

dist/cli/core/io.jsView file

Lines 50-90javascript

50const framework_1 = require("./framework");

51const prompt_1 = require("./prompt");

52// ─── Overwrite protection ──────────────────────────────────────────────────────

53/**

dist/audit/aggregation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 82

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/aggregation.js#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

dist/codegen/type-code.jsView file

377function evaluateTypeCode(expr) { L378: return new Function('DataTypes', `return (${expr});`)(data_types_1.DataTypes); L379: }

High

Eval

Package source references dynamic code evaluation.

dist/codegen/type-code.jsView on unpkg · L377

dist/schema-types.jsView file

32exports.buildNextSequenceValueSQL = buildNextSequenceValueSQL; L33: const schema_objects_1 = require("./schema-objects"); L34: const structured_ddl_1 = require("./structured-ddl");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/schema-types.jsView on unpkg · L32

dist/cli/core/io.jsView file

70const stream = fs.createReadStream(filePath); L71: const res = await fetch(url, { L72: method: 'PUT', L73: // Node's fetch (undici) requires duplex for a stream body. L74: body: stream_1.Readable.toWeb(stream), L75: duplex: 'half', ... L87: if (!res.body) { L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer())); L89: return; ... L160: const g = (0, framework_1.getGlobalOptions)(); L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json; L162: if (!active) {

Findings

1 Critical2 High4 Medium5 Low

CriticalCredential Exfiltrationdist/cli/core/io.js

HighEvaldist/codegen/type-code.js

HighSemantic Analysis Limiteddist/audit/aggregation.js#virtual:normalized:round1

MediumDynamic Requiredist/schema-types.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ts-prorm-orm@4.9.4.

See all versions of ts-prorm-orm for other recorded verdicts.

Review the evidence and your use of ts-prorm-orm@4.9.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 06:31:31.774Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.