registry / @xuda.io/controller_module / 1.1.1195

@xuda.io/controller_module@1.1.1195

Xuda Controller Server Module

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious package-install attack surface was found. Runtime code has high-privilege controller operations and embedded infrastructure credentials, so it is risky if imported outside the intended Xuda server environment.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import/start of index.mjs in a configured Xuda controller environment

Impact

Potential infrastructure mutation and credential exposure if misused or compromised, but no evidence of malicious npm-install behavior

Mechanism

controller cron jobs, CouchDB replication, DigitalOcean volume resize, and rsync deployment automation

Rationale

Static inspection found no install-time execution, unrelated exfiltration, persistence, or AI-agent control hijack. The package should warn because runtime import has high-privilege infrastructure automation and hardcoded database credentials, but the evidence does not support a malicious verdict.

Evidence

package.jsonindex.mjsindex_ms.mjsindex_msa.mjsindex.js/tmp/drv_*/tmp/autonomous-${candidate.country.code}-${candidate.city.slug}.json$XUDA_HOME/utils/network_city_scaffold/autonomous_candidates.json$XUDA_HOME/website-static/xuda.network$XUDA_HOME/website-static/xuda.fashion

Network endpoints7

api.digitalocean.com/v2/volumes/${volume_id}api.digitalocean.com/v2/volumes/${volume_id}/actionsmaster.xuda.aidev.xuda.ai10.8.0.110.8.0.410.8.0.2

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

index.mjs runs substantial controller background timers at import/runtime, not just exported functions.
index.mjs imports child_process and runs df/find, npm build, node scaffolder, rsync over ssh, resize2fs/xfs_growfs under config/host gates.
index.mjs contains a hardcoded CouchDB admin password in replication helper code and commented examples.
index.mjs can call DigitalOcean volume resize API when server_capacity_monitor.auto_grow_enabled is configured.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; only a manual pub script.
No code writes npm, shell, SSH, or AI-agent control-surface configuration during install.
Network and shell behavior is aligned with a Xuda controller/ops module and gated by XUDA_HOME config or XUDA_HOSTNAME.
No credential harvesting from arbitrary user files or exfiltration endpoint unrelated to Xuda/DigitalOcean was found.
index_ms.mjs and index_msa.mjs are generated queue wrappers around controller methods.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 230 KB of source, external domains: api.digitalocean.com

Source & flagged code

5 flagged

index.jsView file

Lines 1492-1532javascript

1492 app_obj.replications.push(ret);

1493 const save_ret = await db.insert(app_obj);

1494 }

1495 return { system_replications, user_replications };

1496};

1497

1498const setup_replication_for_new_regional_server = async function (regional_server_id, master_server_id = 'master') {

1499 const regional_server_ret = await db_module.get_couch_doc('xuda_servers', regional_server_id);

1500 if (regional_server_ret.code < 0) {

1501 return console.error(regional_server_ret);

1502 }

1503 let master_server_ret = await db_module.get_couch_doc('xuda_servers', master_server_id);

1504 if (master_server_ret.code < 0) {

1505 return console.error(master_server_ret);

1506 }

1507

1508 const from_url = {

1509 db_server_http: 'http',

1510 db_server_location: `${master_server_ret.data.private}:5984`,

1511 db_server_username: 'admin',

1512 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L1512

1513 }; // `http://admin:G1qdwb43@${master_server_ret.data.private}:5984/`;

1514 const to_url = {

1515 db_server_http: 'http',

1516 db_server_location: `${regional_server_ret.data.private}:5984`,

1517 db_server_username: 'admin',

1518 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L1518

1519 }; //`http://admin:G1qdwb43@${regional_server_ret.data.private}:5984/`;

1520

1521 let replications_to = await replicate_server(from_url, to_url, { create_target: true, continuous: true }, master_server_ret.data.private);

1522 // setTimeout(() => {

1523 let replications_from = await replicate_server(to_url, from_url, { continuous: true }, master_server_ret.data.private);

1524 // }, 120000);

1525

1526 // get refresh server doc

1527 let master_server_ret_new = await db_module.get_couch_doc('xuda_servers', master_server_id);

1528 if (!master_server_ret_new.data.replications) master_server_ret_new.data.replications = [];

1529 master_server_ret_new.data.replications.push({ replications_to, replications_from });

1530 await db_module.save_couch_doc('xuda_servers', master_server_ret_new.data, true);

1531};

1532

index_ms.mjsView file

Lines 1-28javascript

1// =====================================================

2// Queue wrapper – generated from index.mjs

3// Queue target : controller_module

4// =====================================================

7 import path from 'node:path';

9 const { MessageBroker } = await import(path.

index.mjsView file

Lines 3973-4014javascript

3973 }

3974

3975 await db_module.save_couch_bulk_docs('db_prj_3uh4q1zj0llw3mj4wgifh1', docs);

3976 console.log('delete_docs', 'done');

3977 };

3978

3979 const setup_replication_for_new_regional_server = async function

Source & flagged code

5 flagged · loading source

index.jsView file

1512patternName = generic_password severity = medium line = 1512 matchedText = db_serve...43',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L1512

1518patternName = generic_password severity = medium line = 1518 matchedText = db_serve...43',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L1518

index_ms.mjsView file

8L9: const { MessageBroker } = await import(path.join(process.env.XUDA_HOME, 'common', 'ms_broker.mjs')); L10:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index_ms.mjsView on unpkg · L8

index.mjsView file

3993patternName = generic_password severity = medium line = 3993 matchedText = db_serve...43',

Medium

Secret Pattern

Hardcoded password in index.mjs

index.mjsView on unpkg · L3993

3999patternName = generic_password severity = medium line = 3999 matchedText = db_serve...43',

Medium

Secret Pattern

Hardcoded password in index.mjs

index.mjsView on unpkg · L3999

Findings

7 Medium4 Low

MediumSecret Patternindex.js

MediumDynamic Requireindex_ms.mjs

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternindex.js

MediumSecret Patternindex.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

index.jsView file

Lines 1492-1532javascript

1492 app_obj.replications.push(ret);

1493 const save_ret = await db.insert(app_obj);

1494 }

1495 return { system_replications, user_replications };

1496};

1497

1498const setup_replication_for_new_regional_server = async function (regional_server_id, master_server_id = 'master') {

1499 const regional_server_ret = await db_module.get_couch_doc('xuda_servers', regional_server_id);

1500 if (regional_server_ret.code < 0) {

1501 return console.error(regional_server_ret);

1502 }

1503 let master_server_ret = await db_module.get_couch_doc('xuda_servers', master_server_id);

1504 if (master_server_ret.code < 0) {

1505 return console.error(master_server_ret);

1506 }

1507

1508 const from_url = {

1509 db_server_http: 'http',

1510 db_server_location: `${master_server_ret.data.private}:5984`,

1511 db_server_username: 'admin',

1512 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L1512

1513 }; // `http://admin:G1qdwb43@${master_server_ret.data.private}:5984/`;

1514 const to_url = {

1515 db_server_http: 'http',

1516 db_server_location: `${regional_server_ret.data.private}:5984`,

1517 db_server_username: 'admin',

1518 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L1518

1519 }; //`http://admin:G1qdwb43@${regional_server_ret.data.private}:5984/`;

1520

1521 let replications_to = await replicate_server(from_url, to_url, { create_target: true, continuous: true }, master_server_ret.data.private);

1522 // setTimeout(() => {

1523 let replications_from = await replicate_server(to_url, from_url, { continuous: true }, master_server_ret.data.private);

1524 // }, 120000);

1525

1526 // get refresh server doc

1527 let master_server_ret_new = await db_module.get_couch_doc('xuda_servers', master_server_id);

1528 if (!master_server_ret_new.data.replications) master_server_ret_new.data.replications = [];

1529 master_server_ret_new.data.replications.push({ replications_to, replications_from });

1530 await db_module.save_couch_doc('xuda_servers', master_server_ret_new.data, true);

1531};

1532

index_ms.mjsView file

Lines 1-28javascript

1// =====================================================

2// Queue wrapper – generated from index.mjs

3// Queue target : controller_module

4// =====================================================

7 import path from 'node:path';

9 const { MessageBroker } = await import(path.

index.mjsView file

Lines 3973-4014javascript

3973 }

3974

3975 await db_module.save_couch_bulk_docs('db_prj_3uh4q1zj0llw3mj4wgifh1', docs);

3976 console.log('delete_docs', 'done');

3977 };

3978

3979 const setup_replication_for_new_regional_server = async function