registry / @cartanova/qgrid-cli / 2.3.7

@cartanova/qgrid-cli@2.3.7

Qgrid 서버를 한 줄로 실행. OpenAI/Anthropic 구독 크레딧을 HTTP API + 대시보드로 제공하는 LLM 프록시.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 1,222 file(s), 6.16 MB of source, external domains: api.anthropic.com, auth.openai.com, claude.com, codesandbox.io, developer.mozilla.org, docs.github.com, floating-ui.com, fonts.googleapis.com, fonts.gstatic.com, github.com, json-schema.org, nodejs.org, platform.claude.com, radix-ui.com, react-hook-form.com, react.dev, reactjs.org, spec.commonmark.org, stackoverflow.com, tailwindcss.com, tanstack.com, tools.ietf.org, www.apache.org, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 1-51javascript

1#!/usr/bin/env node

2import { execFileSync, execSync, spawnSync } from "node:child_process";

3import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

4import { dirname, join } from "node:path";

5import { fileURLToPath } from "node:url";

6import { Command } from "commander";

7//#region src/cli.ts

8const __dirname = dirname(fileURLToPath(import.meta.url));

9const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));

10const RUNTIME_CLI_DEPENDENCIES = [{

11 command: "codex",

12 packageName: "@openai/codex",

13 label: "Codex CLI",

14 missingReason: "OpenAI tokens require codex app-server."

15}, {

16 command: "claude",

17 packageName: "@anthropic-ai/claude-code",

18 label: "Claude Code",

19 missingReason: "Anthropic tokens require Claude Code."

20}];

21function commandVersion(command) {

22 try {

23 return execFileSync(command, ["--version"], {

24 encoding: "utf-8",

25 stdio: "pipe"

26 }).trim();

27 } catch {

28 return null;

29 }

30}

31function packageLatestVersion(packageName) {

32 return execFileSync("npm", [

33 "view",

34 packageName,

35 "version"

36 ], {

37 encoding: "utf-8",

38 stdio: "pipe"

39 }).trim();

40}

41function parseVersion(output) {

42 return output?.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] ?? null;

43}

44function warnMissingRuntimeCliDependency(dep) {

45 console.warn(`Warning: ${dep.command} CLI not found. ${dep.missingReason}`);

46 console.warn(`Install: npm i -g ${dep.packageName}`);

47}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L31

48function installRuntimeCliDependency(dep) {

49 execFileSync("npm", [

50 "i",

51 "-g",

Lines 115-155javascript

115 const [, user, password, host, port, dbName] = m;

116 process.env.QGRID_DB_HOST = host;

117 process.env.QGRID_DB_PORT = normalizePort(port);

118 process.env.

bundle/web-dist/server/assets/sd.generated-DdfpD_iN.jsView file

18478try { L18479: new Function(""); L18480: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/sd.generated-DdfpD_iN.jsView on unpkg · L18478

bundle/web-dist/server/entry-server.generated.jsView file

18if (!shouldRedactErrors(error)) return Promise.reject(error); L19: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L20: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L28: ...query.state, L29: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L30: }, ... L397: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L398: let promise = query.fetch(void 0, fetchOptions); L399: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1077: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L18

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code