registry / @cartanova/qgrid-cli / 2.3.6

@cartanova/qgrid-cli@2.3.6

Qgrid 서버를 한 줄로 실행. OpenAI/Anthropic 구독 크레딧을 HTTP API + 대시보드로 제공하는 LLM 프록시.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 1,222 file(s), 6.15 MB of source, external domains: api.anthropic.com, auth.openai.com, claude.com, codesandbox.io, developer.mozilla.org, docs.github.com, floating-ui.com, fonts.googleapis.com, fonts.gstatic.com, github.com, json-schema.org, nodejs.org, platform.claude.com, radix-ui.com, react-hook-form.com, react.dev, reactjs.org, spec.commonmark.org, stackoverflow.com, tailwindcss.com, tanstack.com, tools.ietf.org, www.apache.org, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

6 flagged

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, execSync, spawnSync } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

4import { dirname, join } from "node:path";

5import { fileURLToPath } from "node:url";

6import { Command } from "commander";

7//#region src/cli.ts

8const __dirname = dirname(fileURLToPath(import.meta.url));

9const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));

10const RUNTIME_CLI_DEPENDENCIES = [{

11 command: "codex",

12 packageName: "@openai/codex",

13 label: "Codex CLI",

14 missingReason: "OpenAI tokens require codex app-server."

15}, {

16 command: "claude",

17 packageName: "@anthropic-ai/claude-code",

18 label: "Claude Code",

19 missingReason: "Anthropic tokens require Claude Code."

20}];

21function commandVersion(command) {

Lines 79-155javascript

79 const numeric = Number(value);

80 if (!/^\d+$/.test(value) || numeric < 1 || numeric > 65535

bundle/web-dist/server/assets/sd.generated-DdfpD_iN.jsView file

18478try { L18479: new Function(""); L18480: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/sd.generated-DdfpD_iN.jsView on unpkg · L18478

bundle/web-dist/server/entry-server.generated.jsView file

18if (!shouldRedactErrors(error)) return Promise.reject(error); L19: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L20: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L28: ...query.state, L29: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L30: }, ... L397: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L398: let promise = query.fetch(void 0, fetchOptions); L399: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1077: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L18

bundle/dist/utils/providers/openai/codex-worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cartanova/qgrid-cli@2.4.8 matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.4.8 similarity = 0.593 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bundle/dist/utils/providers/openai/codex-worker.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code