github.com / supabase

supabase/supabase-js

TypeScript·589 files·commit ecab7fb·scanned 18h ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — supabase is a verified organization — findings likely false positives

verdict accurate?

Verified organization

threat-state: lowlive

FINDINGS ░▒▓

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.packages/core/supabase-js/test/bundle-hermes-compat.test.cjs

 *
 * 2. No `new Function(` in shipped CJS files.
 *    Browsers with a strict Content-Security-Policy (no `'unsafe-eval'`)
 *    block `new Function()` identically to `eval()` at runtime.

criticalBrowser wallet app with Node/system accessThe repository interacts with browser wallets but also accesses the filesystem or executes shell/code. This context mismatch is typical of hybrid drainer/infostealer malware.+10

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.packages/core/storage-js/test/storageFileApi.test.ts

      expect(headers['x-metadata']).toBeDefined()
      expect(Buffer.from(headers['x-metadata'], 'base64').toString('utf8')).toBe(
        JSON.stringify(metadata)
      )

infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.packages/core/auth-js/src/lib/types.ts


      /** Wallet interface to use. If not specified will default to `window.solana`. */
      wallet?: SolanaWallet

infoWallet transaction signing APIUses wallet signing APIs (signTransaction, signMessage, sendTransaction, etc.). Legitimate in DeFi apps, but combined with remote exfiltration it is the core drainer pattern.packages/core/auth-js/test/GoTrueClient.test.ts

    await expect(authClient.signInWithWeb3(credentials)).rejects.toThrow(
      '@supabase/auth-js: Wallet does not have a compatible signMessage() and publicKey.toBase58() API'
    )
  })

warningDependency runs install scripts"<root>/preinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

infoAuthor has no other public repositoriesGitHub user "supabase-releaser[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

428 files scanned @ ecab7fb | 10/29/2026 | heuristic scan — always review manually

risk by category

code execution17

network & exfiltration2

file system access4

obfuscation0

supply chain5

owasp / injection0

telemetry

files 428/589rules hit 8engine v7commit ecab7fb

github

supabase/supabase-js

An isomorphic Javascript client for Supabase. Query your Supabase database, subscribe to realtime events, upload and download files, browse typescript examples, invoke postgres functions via rpc, invoke supabase edge functions, query pgvector.

TypeScript

4604

778

2358d

589 files

428 scanned(73%)

ecab7fb

architecture░▒▓

entry (3) flagged (1) pkg (101)

461 nodes · 900 edgesscroll to zoom · click node to jump to finding