registry / ts-prorm-orm / 4.9.5
ts-prorm-orm@4.9.5
⚠ Under reviewA TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more
AI Security Review
scanned 23h ago · by lpm-firewall-aiThe inspected source does not substantiate the scanner's credential-exfiltration or dynamic-evaluation alerts as attacks. A clean verdict requires citations for 391 paths, exceeding the 256-citation limit, so the broader review remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was established in the inspected excerpts.
Impact
No attack impact was established from these excerpts.
Mechanism
The inspected transfer helper uses a supplied presigned URL, and the inspected generated-code evaluator processes generated type expressions.
AI rationale
The inspected source does not substantiate the scanner's credential-exfiltration or dynamic-evaluation alerts as attacks. A clean verdict requires citations for 391 paths, exceeding the 256-citation limit, so the broader review remains unresolved.
Evidence
package.jsondist/cli/core/io.jsdist/codegen/type-code.js
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest routes the package entry point to dist/index.js and declares prepare as a Husky setup command.
- The flagged upload helper streams a file to a supplied presigned URL; this excerpt does not establish where that URL comes from or who selects it.
- The flagged dynamic function evaluation is documented as evaluating generated DataTypes expressions whose inputs are escaped or checked.
Evidence against
- The inspected excerpts do not establish an unconsented credential transfer or another concrete attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/codegen/type-code.jsView file
377function evaluateTypeCode(expr) {
L378: return new Function('DataTypes', `return (${expr});`)(data_types_1.DataTypes);
L379: }
High
dist/schema-types.jsView file
32exports.buildNextSequenceValueSQL = buildNextSequenceValueSQL;
L33: const schema_objects_1 = require("./schema-objects");
L34: const structured_ddl_1 = require("./structured-ddl");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/schema-types.jsView on unpkg · L32dist/cli/core/io.jsView file
70const stream = fs.createReadStream(filePath);
L71: const res = await fetch(url, {
L72: method: 'PUT',
L73: // Node's fetch (undici) requires duplex for a stream body.
L74: body: stream_1.Readable.toWeb(stream),
L75: duplex: 'half',
...
L87: if (!res.body) {
L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
L89: return;
...
L160: const g = (0, framework_1.getGlobalOptions)();
L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json;
L162: if (!active) {
Findings
1 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli/core/io.js
HighEvaldist/codegen/type-code.js
HighSemantic Analysis Limiteddist/audit/aggregation.js#virtual:normalized:round1
MediumDynamic Requiredist/schema-types.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ts-prorm-orm@4.9.5.
See all versions of ts-prorm-orm for other recorded verdicts.
- Review the evidence and your use of ts-prorm-orm@4.9.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.