Loading npm security reports…

velocious@1.0.521: Suspicious npm security report (Warn) | LPM Firewall

registry / velocious / 1.0.521

velocious@1.0.521

* Concurrent multi threadded web server * Database framework with familiar MVC concepts * Database models with migrations and validations * Database models that work almost the same in frontend and backend * Built-in record auditing for model lifecycle ch

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,367 file(s), 16.7 MB of source, external domains: sql.js.org

Source & flagged code

17 flagged

build/database/drivers/pgsql/sql/create-database.jsView file

Lines 4-39javascript

5export default class VelociousDatabaseConnectionDriversPgsqlSqlCreateDatabase extends CreateDatabaseBase {

6 toSql() {

7 const {databaseName} = this

8 const options = this.getOptions()

9 const sqls = []

11 if (this.ifNotExists) {

12 sqls.push("CREATE EXTENSION IF NOT EXISTS dblink")

14 const connectArgs = this._driver.getArgs()

15 const {password, username} = connectArgs

16 const port = connectArgs.port || 5432

17 const sql = `

18 DO

19 $do$

20 BEGIN

21 IF EXISTS (SELECT FROM ${options.quoteTableName("pg_database")} WHERE ${options.quoteColumnName("datname")} = ${options.quote(databaseName)}) THEN

22 RAISE NOTICE 'Database already exists'; -- optional

23 ELSE

24 PERFORM dblink_connect('host=localhost port=' || ${port} || ' user=' || ${options.quote(username)} || ' password=' || ${options.quote(password)} || ' dbname=' || current_database());

Medium

Secret Pattern

Package contains a possible secret pattern.

build/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

25 PERFORM dblink_exec('CREATE DATABASE ' || ${options.quote(databaseName)});

26 END IF;

27 END

28 $do$;

29 `

31 sqls.push(sql)

32 } else {

33 sqls.push(`CREATE DATABASE ${options.quoteDatabaseName(databaseName)}`)

34 }

36 return sqls

37 }

38}

build/database/record/attachments/storage-drivers/s3.jsView file

Lines 7-47javascript

7 */

8function throwS3ConfigurationError(message) {

9 throw new Error(`Invalid S3 attachment storage configuration: ${message}`)

10}

scripts/test-browser.jsView file

Lines 85-125javascript

85 sourcemap: true

86 })

88 const html = `<!doctype html>

89<html lang="en">

90 <head>

91 <meta charset="utf-8" />

92 <meta name="viewport" content="width=device-width, initial-scale=1" />

build/http-server/client/index.jsView file

Lines 1-30javascript

1// @ts-check

3import crypto from "crypto"

4import fs from "node:fs/promises"

5import {digg} from "diggerize"

6import {ensureError} from "typanic"

package.jsonView file

Lines 1-37json

2 "bin": {

3 "velocious": "build/bin/velocious.js"

4 },

5 "name": "velocious",

6 "version": "1.0.521",

7 "main"

build/background-jobs/worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = velocious@1.0.517 matchedIdentity = npm:dmVsb2Npb3Vz:1.0.517 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/background-jobs/worker.jsView on unpkg

build/templates/configuration.jsView file

Lines 1-60javascript

1import AsyncTrackedMultiConnection from "velocious/build/src/database/pool/async-tracked-multi-connection.js"

2import Configuration from "velocious/build/src/configuration.js"

3import fs from "fs/promises"

4import InitializerFromRequireContext from "../../../../src/database/initializer-from-require-context.js"

build/src/database/drivers/pgsql/sql/create-database.jsView file

20patternName = generic_password severity = medium line = 20 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in build/src/database/drivers/pgsql/sql/create-database.js

build/src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L20

build/src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L40

src/database/drivers/pgsql/sql/create-database.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in src/database/drivers/pgsql/sql/create-database.js

src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L40

Source & flagged code

17 flagged · loading source

build/database/drivers/pgsql/sql/create-database.jsView file

Source & flagged code

17 flagged

build/database/drivers/pgsql/sql/create-database.jsView file

Lines 4-39javascript

5export default class VelociousDatabaseConnectionDriversPgsqlSqlCreateDatabase extends CreateDatabaseBase {

6 toSql() {

7 const {databaseName} = this

8 const options = this.getOptions()

9 const sqls = []

11 if (this.ifNotExists) {

12 sqls.push("CREATE EXTENSION IF NOT EXISTS dblink")

14 const connectArgs = this._driver.getArgs()

15 const {password, username} = connectArgs

16 const port = connectArgs.port || 5432

17 const sql = `

18 DO

19 $do$

20 BEGIN

21 IF EXISTS (SELECT FROM ${options.quoteTableName("pg_database")} WHERE ${options.quoteColumnName("datname")} = ${options.quote(databaseName)}) THEN

22 RAISE NOTICE 'Database already exists'; -- optional

23 ELSE

24 PERFORM dblink_connect('host=localhost port=' || ${port} || ' user=' || ${options.quote(username)} || ' password=' || ${options.quote(password)} || ' dbname=' || current_database());

Medium

Secret Pattern

Package contains a possible secret pattern.

build/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

25 PERFORM dblink_exec('CREATE DATABASE ' || ${options.quote(databaseName)});

26 END IF;

27 END

28 $do$;

29 `

31 sqls.push(sql)

32 } else {

33 sqls.push(`CREATE DATABASE ${options.quoteDatabaseName(databaseName)}`)

34 }

36 return sqls

37 }

38}

build/database/record/attachments/storage-drivers/s3.jsView file

Lines 7-47javascript

7 */

8function throwS3ConfigurationError(message) {

9 throw new Error(`Invalid S3 attachment storage configuration: ${message}`)

10}

scripts/test-browser.jsView file

Lines 85-125javascript

85 sourcemap: true

86 })

88 const html = `<!doctype html>

89<html lang="en">

90 <head>

91 <meta charset="utf-8" />

92 <meta name="viewport" content="width=device-width, initial-scale=1" />

build/http-server/client/index.jsView file

Lines 1-30javascript

1// @ts-check

3import crypto from "crypto"

4import fs from "node:fs/promises"

5import {digg} from "diggerize"

6import {ensureError} from "typanic"

package.jsonView file

Lines 1-37json

2 "bin": {

3 "velocious": "build/bin/velocious.js"

4 },

5 "name": "velocious",

6 "version": "1.0.521",

7 "main"

build/background-jobs/worker.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/background-jobs/worker.jsView on unpkg

build/templates/configuration.jsView file

Lines 1-60javascript

1import AsyncTrackedMultiConnection from "velocious/build/src/database/pool/async-tracked-multi-connection.js"

2import Configuration from "velocious/build/src/configuration.js"

3import fs from "fs/promises"

4import InitializerFromRequireContext from "../../../../src/database/initializer-from-require-context.js"

build/src/database/drivers/pgsql/sql/create-database.jsView file

20patternName = generic_password severity = medium line = 20 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in build/src/database/drivers/pgsql/sql/create-database.js

build/src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L20

build/src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in build/src/templates/configuration.js

build/src/templates/configuration.jsView on unpkg · L40

src/database/drivers/pgsql/sql/create-database.jsView file

24patternName = generic_password severity = medium line = 24 matchedText = PERFORM ...());

Medium

Secret Pattern

Hardcoded password in src/database/drivers/pgsql/sql/create-database.js

src/database/drivers/pgsql/sql/create-database.jsView on unpkg · L24

src/templates/configuration.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L18

29patternName = generic_password severity = medium line = 29 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L29

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/templates/configuration.js

src/templates/configuration.jsView on unpkg · L40

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code