registry  /  iobroker.aura  /  0.14.1

iobroker.aura@0.14.1

Modern visualization dashboard for ioBroker

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Runtime proxying, file reads, timers, logs, and adapter control are visible product features for an ioBroker visualization dashboard, but they are not install-time or stealth behavior.

Static reason
No blocking static signals were detected.
Trigger
ioBroker adapter runtime and authenticated/user-driven dashboard or sendTo actions
Impact
Runtime features can reach user-supplied URLs or configured local files when invoked, but source shows no credential harvesting, exfiltration, persistence, or destructive install behavior.
Mechanism
local dashboard server with proxy, configured-root file browser, calendar fetch, scheduler, and ioBroker management RPCs
Rationale
Static inspection found an ioBroker visualization adapter with expected runtime HTTP/WebSocket proxying, calendar fetch, bounded file browsing, timers, and management RPCs, but no lifecycle hooks, covert payload execution, credential collection, exfiltration, or AI-agent control-surface mutation. The risky primitives are user/config driven and package-aligned, so this should be marked clean.
Evidence
package.jsonmain.jslib/webExtension.jsio-package.jsonwww/assets/echarts-Cv-_nZ52.jswww/assets/index-BgadQTfb.js/opt/iobroker/iobroker-data/files
Network endpoints3
raw.githubusercontent.com/hdering/ioBroker.aura/main/admin/aura.pnggithub.com/hdering/ioBroker.auragithub.com/hdering/ioBroker.aura/issues

Decision evidence

public snapshot
AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for block
  • main.js exposes user-invoked /proxy and /proxyws forwarding to caller-supplied http/https/ws/wss URLs.
  • main.js /fs/list and /fs/read expose configured fsRoots only; io-package.json defaults fsRoots to /opt/iobroker/iobroker-data/files.
  • main.js onMessage can restart/upgrade adapters and toggle script objects via ioBroker host/controller APIs.
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle hooks and main is main.js.
  • Network code is package-aligned: dashboard server, ioBroker socket proxy, iframe proxy, and calendar URL fetch on frontend state request.
  • No child_process, eval/vm/Function, native binary, or install-time mutation found in inspected source.
  • Filesystem reads are bounded by configured roots with path.resolve checks and symlink realpath validation; no arbitrary write endpoints found.
  • ioBroker object/state mutations create adapter-owned states, user-requested client/timer/list cleanup, or explicit adapter/script management RPCs.
  • Bundled www assets appear to be built React/vendor UI assets; dynamic imports are Vite chunk loading.
Behavioral surface
Source
ChildProcessEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 38 file(s), 3.80 MB of source, external domains: 192.168.1.x, api.iconify.design, api.simplesvg.com, api.unisvg.com, bit.ly, calendar.google.com, cdn.jsdelivr.net, fb.me, fonts.googleapis.com, github.com, hdering.github.io, leafletjs.com, photon.komoot.io, reactjs.org, redux-toolkit.js.org, redux.js.org, server.arcgisonline.com, www.w3.org

Source & flagged code

1 flagged · loading source
www/assets/echarts-Cv-_nZ52.jsView file
39`+g.message)}var n=new it;n.add(a),n.isGeoSVGGraphicRoot=!0;var i=e.width,o=e.height,s=e.viewBoxRect,l=this._boundingRect;if(!l){var u=void 0,f=void 0,v=void 0,h=void 0;if(i!=null?... L40: `+i.message)}return o8(e,n),A(n,function(i){var o=i.name;l8(e,i),f8(e,i);var s=this._specialAreas&&this._specialAreas[o];s&&i.transformTo(s.left,s.top,s.width,s.height)},this),n},r... L41: `))}),t.join(`
Low
Eval

Package source references a known benign dynamic code generation pattern.

www/assets/echarts-Cv-_nZ52.jsView on unpkg · L39

Findings

2 Medium7 Low
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalwww/assets/echarts-Cv-_nZ52.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings