@s-hirano-ist/s-database
16
Versions
—
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
s-hirano-ist
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Prisma's own wasm query-compiler binary, standard generated client artifact. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Fires in generated Prisma client runtime; standard Prisma pattern for env config, not malicious. | ai | |
| source-diff | obfuscated-file:src/generated/query_compiler_fast_bg.js | AI (source-diff): wasm-bindgen JS glue; minified by design, not obfuscated malware. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:src/generated/query_compiler_fast_bg.wasm-base64.js | AI (source-diff): Base64-encoded WASM binary (AGFzbQ header confirms); standard wasm-bindgen distribution pattern. | ai | |
| phantom-deps | phantom-dep:@prisma/extension-accelerate | AI (phantom-deps): Declared as a runtime dependency in package.json; phantom-dep heuristic misfires for Prisma extension packages. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Runs prisma:generate — standard Prisma client codegen step, stable for this package. | ai | |
| phantom-deps | phantom-dep:@prisma/client | AI (phantom-deps): Same as above — config-level reference in a Prisma wrapper is expected, not a phantom dep concern. | ai | |
| phantom-deps | phantom-dep:prisma | AI (phantom-deps): Prisma is referenced in config/scripts, not imported directly; expected for a Prisma wrapper package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decode fires in minified Prisma runtime client.js; standard bundled code pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is Prisma's WASM binary loading pattern in generated client code, not malicious. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 1.19.0 | 4 / 3 | |
| 1.18.5 | 4 / 3 | |
| 1.12.0 | 4 / 2 | |
| 1.11.0 | 3 / 2 | |
| 1.9.0 | 3 / 2 | |
| 1.8.2 | 3 / 2 | |
| 1.8.1 | 3 / 2 | |
| 1.6.0 | 3 / 2 | |
| 1.3.1 | 2 / 3 | |
| 1.3.0 | 2 / 3 | |
| 1.1.6 | 2 / 3 | |
| 1.1.4 | 2 / 2 | |
| 1.1.2 | 2 / 2 | |
| 1.1.1 | 2 / 2 | |
| 1.1.0 | 2 / 2 | |
| 1.0.0 | 2 / 2 |
v1.12.0
2 findings
HIGH
Bundled binary files (1)
npm-metadata
Package contains compiled binaries that could be backdoors: • src/generated/query_compiler_fast_bg.wasm
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.11.0
2 findings
HIGH
Bundled binary files (1)
npm-metadata
Package contains compiled binaries that could be backdoors: • src/generated/query_compiler_fast_bg.wasm
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.