22,000 Stars, a '25 MB' Badge and 443 MB of Java Agents: Auditing the DBX Database Client

Wed, 30 Sep 2026 00:00:00 +0000

There is a database client called DBX that has been impossible to miss since the spring. Its GitHub repository describes itself as “25 MB lightweight cross-platform database client for 100+ databases”. Its website, at the top of the page, says “25 MB to manage 100+ databases!”. It has 21,998 stars, 2,087 forks and 306 releases in 154 days — two per day.

I have spent this audit doing one thing: reading the objects the project actually ships. Not the README, not the badges — the installers, the container image, the machine-readable driver manifest the application itself downloads at runtime, the release notes and the authentication middleware. Most of the numbers below are reproducible in an afternoon by anyone with curl and a GitHub token. That is the point: none of them require privileged access or a source-code review, and several of them contradict the top of the funnel.

Database Client on SoloSoft

22,000 Stars, a '25 MB' Badge and 443 MB of Java Agents: Auditing the DBX Database Client