typeorm
Data-Mapper ORM for TypeScript and ES2021+. Supports MySQL/MariaDB, PostgreSQL, MS SQL Server, Oracle, SAP HANA, SQLite, MongoDB databases.
100
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
michaelbromleypleerock
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): TypeORM CLI uses process.env spread to forward environment to child processes (spawnSync). This is standard CLI behavior, not secret exfiltration. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used to load user-specified ORM config files (ormconfig.json etc.) — core documented TypeORM functionality. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): TypeORM ships CLI binaries that legitimately use child_process to spawn ts-node subprocesses. Expected for a CLI tool. | ai |
Versions (showing 100 of 209)
Showing 100 of 209
Next page →
v1.1.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.31
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.