typeorm
Data-Mapper ORM for TypeScript and ES2021+. Supports MySQL/MariaDB, PostgreSQL, MS SQL Server, Oracle, SAP HANA, SQLite, MongoDB databases.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): TypeORM CLI uses process.env spread to forward environment to child processes (spawnSync). This is standard CLI behavior, not secret exfiltration. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used to load user-specified ORM config files (ormconfig.json etc.) — core documented TypeORM functionality. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): TypeORM ships CLI binaries that legitimately use child_process to spawn ts-node subprocesses. Expected for a CLI tool. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.0.0 | 10 / 3 | |
| 0.3.30 | 15 / 58 | |
| 0.3.29 | 15 / 58 | |
| 0.3.28 | 15 / 56 | |
| 0.3.27 | 14 / 55 | |
| 0.3.26 | 14 / 55 |
v1.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.30
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.29
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.28
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/typeorm/typeorm/blob/73fda419e4647c10377b28bd975171156c285693/browser/cli-ts-node-esm.js#L8 6 | const childProcess = spawnSync(process.argv[0], process.argv.slice(1), { 7 | stdio: "inherit", > 8 | env: { 9 | ...process.env, 10 | NODE_OPTIONS: [
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/typeorm/typeorm/blob/73fda419e4647c10377b28bd975171156c285693/cli-ts-node-esm.js#L10 8 | const childProcess = (0, child_process_1.spawnSync)(process.argv[0], process.argv.slice(1), { 9 | stdio: "inherit", > 10 | env: { 11 | ...process.env, 12 | NODE_OPTIONS: [
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.27
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.26
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.