registry / velocious / 1.0.496

velocious@1.0.496

* Concurrent multi threadded web server * Database framework with familiar MVC concepts * Database models with migrations and validations * Database models that work almost the same in frontend and backend * Built-in record auditing for model lifecycle ch

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 25 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,319 file(s), 15.3 MB of source, external domains: sql.js.org

Source & flagged code

17 flagged

build/database/drivers/pgsql/sql/create-database.jsView file

Lines 4-39javascript

5export default class VelociousDatabaseConnectionDriversPgsqlSqlCreateDatabase extends CreateDatabaseBase {

6 toSql() {

7 const {databaseName} = this

8 const options = this.getOptions()

9 const sqls = []

11 if (this.ifNotExists) {

12 sqls.push("CREATE EXTENSION IF NOT EXISTS dblink")

14 const connectArgs = this._driver.getArgs()

15 const {password, username} = connectArgs

16 const port = connectArgs.port || 5432

17 const sql = `

18 DO

19 $do$

20 BEGIN

21 IF EXISTS (SELECT FROM ${options.quoteTableName("pg_database")} WHERE ${options.quoteColumnName("datname")} = ${options.quote(databaseName)}) THEN

22 RAISE NOTICE 'Database already exists'; -- optional

23 ELSE

24 PERFORM dblink_connect('host=localhost port=' || ${port} || ' user=' || ${options.quote(username)} || ' password=' || ${options.quote(password)} || ' dbname=' || current_database());

Medium

Secret Pattern

Package contains a possible secret pattern.

build/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

25 PERFORM dblink_exec('CREATE DATABASE ' || ${options.quote(databaseName)});

26 END IF;

27 END

28 $do$;

29 `

31 sqls.push(sql)

32 } else {

33 sqls.push(`CREATE DATABASE ${options.quoteDatabaseName(databaseName)}`)

34 }

36 return sqls

37 }

38}

build/database/record/attachments/storage-drivers/s3.jsView file

Lines 7-47javascript

7 */

8function throwS3ConfigurationError(message) {

9 throw new Error(`Invalid S3 attachment storage configuration: ${message}`)

10}

12/**

13 * Runs is readable stream.

14 *

scripts/test-browser.jsView file

Lines 85-125javascript

85 sourcemap: true

86 })

88 const html = `<!doctype html>

89<html lang="en">

90 <head>

91 <meta charset="utf-8" />

92 <meta name="viewport" content="width=device-width, initial-scale=1" />

93 <title>Velocious Browser Tests</title>

94 </head>

build/http-server/client/index.jsView file

Lines 1-31javascript

1// @ts-check

3import crypto from "crypto"

4import fs from "node:fs/promises"

5import {createReadStream} from "node:fs"

6import {digg} from "diggerize"

7import {ensureError} from "typanic"

package.jsonView file

Lines 1-37json

2 "bin": {

3 "velocious": "build/bin/velocious.js"

4 },

5 "name": "velocious",

6 "version": "1.0.496",

7 "main": "build/index.js",

8 "types":

scripts/run-tests.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = velocious@1.0.494 matchedIdentity = npm:dmVsb2Npb3Vz:1.0.494 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/run-tests.jsView on unpkg

build/templates/configuration.jsView file

Lines 1-60javascript

1import AsyncTrackedMultiConnection from "velocious/build/src/database/pool/async-tracked-multi-connection.js"

2import Configuration from "velocious/build/src/configuration.js"

3import fs from "fs/promises"

4import InitializerFromRequireContext from "../../../../src/database/initializer-from-require-context.js"

5import MysqlDriver from "velocious/build/src/database/drivers/mysql/index.js"

6import

build/src/database/drivers/pgsql/sql/create-database.jsView file

20patternName = generic_password severity = medium line = 20 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in build/src/database/drivers/pgsql/sql/create-database.js

build/src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L20

build/src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L40

src/database/drivers/pgsql/sql/create-database.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in src/database/drivers/pgsql/sql/create-database.js

src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L40

Source & flagged code

17 flagged · loading source

build/database/drivers/pgsql/sql/create-database.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = PERFORM ...());

Medium

Secret Pattern

Package contains a possible secret pattern.

build/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

build/database/record/attachments/storage-drivers/s3.jsView file

27const importer = /** @type {(moduleSpecifier: string) => Promise<?>} */ ( L28: new Function("moduleSpecifier", "return import(moduleSpecifier)") L29: )

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/database/record/attachments/storage-drivers/s3.jsView on unpkg · L27

scripts/test-browser.jsView file

105/** L106: * @returns {Promise<import("sql.js").Database>} - The SQL.js database instance. L107: */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/test-browser.jsView on unpkg · L105

build/http-server/client/index.jsView file

11import RequestRunner from "./request-runner.js" L12: import WebsocketSession from "./websocket-session.js" L13: ... L254: .update(`${secWebsocketKey}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`, "binary") L255: .digest("base64") L256: const httpVersion = this.currentRequest.httpVersion() || "1.1" ... L487: * Returns true for the status codes that RFC 7230 §3.3.3 declares L488: * cannot carry a message body: every 1xx informational, 204 No L489: * Content, and 304 Not Modified.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

build/http-server/client/index.jsView on unpkg · L11

package.jsonView file

•Remote tarball dependency specs: eslint-plugin-jsdoc-inline-type-casts@https://github.com/kaspernj/eslint-plugin-jsdoc-inline-type-casts/archive/refs/heads/master.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

scripts/run-tests.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/run-tests.jsView on unpkg

build/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/templates/configuration.js

build/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/templates/configuration.js

build/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/templates/configuration.js

build/templates/configuration.jsView on unpkg · L40

build/src/database/drivers/pgsql/sql/create-database.jsView file

20patternName = generic_password severity = medium line = 20 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in build/src/database/drivers/pgsql/sql/create-database.js

build/src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L20

build/src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L40

src/database/drivers/pgsql/sql/create-database.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in src/database/drivers/pgsql/sql/create-database.js

src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L40

Findings

1 High17 Medium7 Low

HighPrevious Version Dangerous Deltascripts/run-tests.js

MediumSecret Patternbuild/database/drivers/pgsql/sql/create-database.js

MediumDynamic Requirescripts/test-browser.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

MediumSecret Patternbuild/templates/configuration.js

MediumSecret Patternbuild/src/database/drivers/pgsql/sql/create-database.js

MediumSecret Patternbuild/src/templates/configuration.js

MediumSecret Patternsrc/database/drivers/pgsql/sql/create-database.js

MediumSecret Patternsrc/templates/configuration.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbuild/database/record/attachments/storage-drivers/s3.js

LowWeak Cryptobuild/http-server/client/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

17 flagged

build/database/drivers/pgsql/sql/create-database.jsView file

Lines 4-39javascript

5export default class VelociousDatabaseConnectionDriversPgsqlSqlCreateDatabase extends CreateDatabaseBase {

6 toSql() {

7 const {databaseName} = this

8 const options = this.getOptions()

9 const sqls = []

11 if (this.ifNotExists) {

12 sqls.push("CREATE EXTENSION IF NOT EXISTS dblink")

14 const connectArgs = this._driver.getArgs()

15 const {password, username} = connectArgs

16 const port = connectArgs.port || 5432

17 const sql = `

18 DO

19 $do$

20 BEGIN

21 IF EXISTS (SELECT FROM ${options.quoteTableName("pg_database")} WHERE ${options.quoteColumnName("datname")} = ${options.quote(databaseName)}) THEN

22 RAISE NOTICE 'Database already exists'; -- optional

23 ELSE

24 PERFORM dblink_connect('host=localhost port=' || ${port} || ' user=' || ${options.quote(username)} || ' password=' || ${options.quote(password)} || ' dbname=' || current_database());

Medium

Secret Pattern

Package contains a possible secret pattern.

build/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

25 PERFORM dblink_exec('CREATE DATABASE ' || ${options.quote(databaseName)});

26 END IF;

27 END

28 $do$;

29 `

31 sqls.push(sql)

32 } else {

33 sqls.push(`CREATE DATABASE ${options.quoteDatabaseName(databaseName)}`)

34 }

36 return sqls

37 }

38}

build/database/record/attachments/storage-drivers/s3.jsView file

Lines 7-47javascript

7 */

8function throwS3ConfigurationError(message) {

9 throw new Error(`Invalid S3 attachment storage configuration: ${message}`)

10}

12/**

13 * Runs is readable stream.

14 *

scripts/test-browser.jsView file

Lines 85-125javascript

85 sourcemap: true

86 })

88 const html = `<!doctype html>

89<html lang="en">

90 <head>

91 <meta charset="utf-8" />

92 <meta name="viewport" content="width=device-width, initial-scale=1" />

93 <title>Velocious Browser Tests</title>

94 </head>

build/http-server/client/index.jsView file

Lines 1-31javascript

1// @ts-check

3import crypto from "crypto"

4import fs from "node:fs/promises"

5import {createReadStream} from "node:fs"

6import {digg} from "diggerize"

7import {ensureError} from "typanic"

package.jsonView file

Lines 1-37json

2 "bin": {

3 "velocious": "build/bin/velocious.js"

4 },

5 "name": "velocious",

6 "version": "1.0.496",

7 "main": "build/index.js",

8 "types":

scripts/run-tests.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/run-tests.jsView on unpkg

build/templates/configuration.jsView file

Lines 1-60javascript

1import AsyncTrackedMultiConnection from "velocious/build/src/database/pool/async-tracked-multi-connection.js"

2import Configuration from "velocious/build/src/configuration.js"

3import fs from "fs/promises"

4import InitializerFromRequireContext from "../../../../src/database/initializer-from-require-context.js"

5import MysqlDriver from "velocious/build/src/database/drivers/mysql/index.js"

6import

build/src/database/drivers/pgsql/sql/create-database.jsView file

20patternName = generic_password severity = medium line = 20 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in build/src/database/drivers/pgsql/sql/create-database.js

build/src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L20

build/src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L40

src/database/drivers/pgsql/sql/create-database.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in src/database/drivers/pgsql/sql/create-database.js

src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L40