cloudflare-durable-objects

No malicious behavior or supply-chain backdoor is evident. The code demonstrates legitimate RpcTarget usage, with parameterized SQL and no suspicious execution or network activity. However, the examples contain security design weaknesses if deployed directly: request-controlled names and metadata are trusted, and the X-First-Request header can trigger initialization and overwrite persistent metadata without authorization. Authentication, authorization, validation, immutable initialization, and tenant-isolation checks are required in production.

No clear malicious behavior or supply-chain backdoor is present. The code is an instructional Durable Objects example, but it contains security and reliability concerns: unvalidated WebSocket JSON is broadcast and persisted, and the archival alarm can delete unarchived data because the R2 write is disabled and the DELETE is broader than the limited SELECT. Add strict input validation and limits, handle parse errors, verify authoritative routing headers, and delete only records successfully archived.

The code appears to implement legitimate Cloudflare Durable Object functionality and contains no clear malicious behavior. Its main security weaknesses are missing authentication and authorization, unrestricted RPC inputs, potentially sensitive logging/broadcasting, caller-controlled rate-limit parameters, and an incorrect session upsert implementation caused by generating a new primary key for every activity update. SQL queries are parameterized, and no direct code injection or data exfiltration mechanism is present.