ts-prorm-orm@4.9.6

⚠ Under review

A TypeScript ORM for MySQL, PostgreSQL, SQLite, MSSQL, and more

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Inspected the manifest and flagged runtime paths; their observed behavior did not establish a concrete attack. The required clean citation set contains 391 distinct paths, exceeding the 256-citation limit, so manual review is required rather than a clean verdict.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

No malicious trigger was confirmed in the inspected paths.

Impact

No attack impact was established from the inspected source.

Mechanism

The inspected helper uploads a supplied file to a supplied URL, while the dynamic evaluation handles generated type expressions.

AI rationale

Evidence

package.jsondist/cli/core/io.jsdist/codegen/type-code.jsdist/cli/core/cloud.jsdist/schema-types.js

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json defines prepublishOnly as build, package-check, and test steps, and prepare as a Husky setup command.
The flagged upload helper streams a caller-supplied file to a supplied URL; no credential collection is shown in that helper.
The flagged evaluation operates on generated type expressions; descriptor handling routes noncanonical inputs to a native-type fallback.
The cloud API uses an explicitly supplied token or a configured session to authenticate its requests.
The flagged schema-types imports are fixed relative module paths.

Evidence against

The inspected flagged paths do not establish credential theft, an install-time attack, or another concrete attack chain.
A clean verdict cannot be supported within the 256-citation limit because the required clean coverage lists 391 distinct paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Source & flagged code

4 flagged

dist/codegen/type-code.jsView file

Lines 357-397javascript

357 case 'VECTOR':

358 return 'number[]';

359 case 'ARRAY':

360 case 'LIST': {

361 const el = descriptorToTsType(d.element);

362 return /^[\w.]+$/.test(el) ? `${el}[]` : `Array<${el}>`;

363 }

364 case 'HSTORE':

365 return 'Record<string, string | null>';

366 default:

367 return 'unknown';

368 }

369}

370/**

371 * Evaluate generated type code into the `DataType` it builds.

372 *

373 * The expression is generator output — `DataTypes` calls whose every argument

374 * went through {@link tsString} or a number check — so no catalog text is

375 * evaluated as code.

376 */

377function evaluateTypeCode(expr) {

378 return new Function('DataTypes', `return (${expr});`)(data_types_1.DataTypes);

379}

High

Eval

Package source references dynamic code evaluation.

dist/codegen/type-code.jsView on unpkg · L377

380/**

381 * The type code for a column read from `dialect`: the portable

382 * `DataTypes.X(...)` call when `dialect` recreates the same column from it,

383 * else the native type verbatim.

384 *

385 * "The same column" is checked, not assumed: the portable type is rendered

386 * with the dialect's own `getDataTypeSql()` and mapped back with its

387 * `mapNativeType()`. When the engine cannot create the type (SQLite has no

388 * BIT), or creates a different one (CockroachDB's `INTEGER` is 64-bit; legacy

389 * type mapping widens some types), the native string is kept so `sync()`

390 * recreates exactly the column that was read.

391 */

392function resolveTypeCode(descriptor, options) {

393 const code = descriptorToCode(descriptor, {

394 nativeType: options.nativeType,

395 nativeBase: (0, type_normalize_1.parseNativeType)(options.nativeType).base,

396 dataTypes: options.dataTypes,

397 });

dist/schema-types.jsView file

Lines 12-52javascript

12 *

13 * Values reaching SQL here are literals, not identifiers: an enum's members, a

14 * comment's text, a domain's default. Each goes through {@link quoteLiteral}

15 * rather than being interpolated.

16 */

dist/cli/core/io.jsView file

Lines 50-90javascript

50const framework_1 = require("./framework");

51const prompt_1 = require("./prompt");

52// ─── Overwrite protection ──────────────────────────────────────────────────────

53/**

dist/audit/aggregation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 80

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/aggregation.js#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

dist/codegen/type-code.jsView file

377function evaluateTypeCode(expr) { L378: return new Function('DataTypes', `return (${expr});`)(data_types_1.DataTypes); L379: }

High

Eval

Package source references dynamic code evaluation.

dist/codegen/type-code.jsView on unpkg · L377

dist/schema-types.jsView file

32exports.buildNextSequenceValueSQL = buildNextSequenceValueSQL; L33: const schema_objects_1 = require("./schema-objects"); L34: const structured_ddl_1 = require("./structured-ddl");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/schema-types.jsView on unpkg · L32

dist/cli/core/io.jsView file

70const stream = fs.createReadStream(filePath); L71: const res = await fetch(url, { L72: method: 'PUT', L73: // Node's fetch (undici) requires duplex for a stream body. L74: body: stream_1.Readable.toWeb(stream), L75: duplex: 'half', ... L87: if (!res.body) { L88: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer())); L89: return; ... L160: const g = (0, framework_1.getGlobalOptions)(); L161: const active = Boolean(process.stderr.isTTY) && !g.quiet && !g.json; L162: if (!active) {

Findings

1 Critical2 High4 Medium5 Low

CriticalCredential Exfiltrationdist/cli/core/io.js

HighEvaldist/codegen/type-code.js

HighSemantic Analysis Limiteddist/audit/aggregation.js#virtual:normalized:round1

MediumDynamic Requiredist/schema-types.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ts-prorm-orm@4.9.6.

See all versions of ts-prorm-orm for other recorded verdicts.

Review the evidence and your use of ts-prorm-orm@4.9.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 06:32:19.169Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.