registry / kordoc / 3.12.0

kordoc@3.12.0

Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff, print & layout-preserving SVG renderer

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 2.38 MB of source, external domains: github.com, huggingface.co, www.hancom.co.kr, www.idpf.org, www.w3.org

Source & flagged code

2 flagged

dist/watch-Y7BAYXJE.jsView file

Lines 7-47javascript

7} from "./chunk-MEPHGCPQ.js";

8import "./chunk-ILR7GF3W.js";

9import "./chunk-BUDM6ULT.js";

10import "./chunk-MOL7MDBG.js";

11import {

12 toArrayBuffer

13} from "./chunk-7Z43WEML.js";

15// src/watch.ts

16import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

17import { basename, resolve, extname, sep } from "path";

18var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

19var DEBOUNCE_MS = 1e3;

20var STABLE_CHECK_MS = 300;

21var MAX_FILE_SIZE = 500 * 1024 * 1024;

22async function watchDirectory(options) {

23 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

24 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

25 if (webhook) validateWebhookUrl(webhook);

26 if (outDir) mkdirSync(outDir, { recursive: true });

27 const log = silent ? () => {

28 } : (msg) => process.stderr.write(msg + "\n");

29 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-Y7BAYXJE.jsView on unpkg · L27

30 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

31 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

32 const pending = /* @__PURE__ */ new Map();

33 const MAX_CONCURRENT = 3;

34 let activeCount = 0;

35 const inProgress = /* @__PURE__ */ new Set();

36 const waitForStableSize = async (absPath) => {

37 let prevSize = statSync(absPath).size;

38 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

39 if (!existsSync(absPath)) return 0;

40 const currSize = statSync(absPath).size;

41 if (currSize !== prevSize) {

42 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

43 if (!existsSync(absPath)) return 0;

44 return statSync(absPath).size;

45 }

46 return currSize;

47 };

dist/chunk-RUYSNNYZ.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kordoc@3.8.3 matchedIdentity = npm:a29yZG9j:3.8.3 similarity = 0.552 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-RUYSNNYZ.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/watch-Y7BAYXJE.jsView file

27const log = silent ? () => { L28: } : (msg) => process.stderr.write(msg + "\n"); L29: log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`); ... L137: validateWebhookUrl(url); L138: await fetch(url, { L139: method: "POST",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-Y7BAYXJE.jsView on unpkg · L27

dist/chunk-RUYSNNYZ.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-RUYSNNYZ.jsView on unpkg

Findings

2 High3 Medium5 Low

HighCloud Metadata Accessdist/watch-Y7BAYXJE.js

HighPrevious Version Dangerous Deltadist/chunk-RUYSNNYZ.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/watch-Y7BAYXJE.jsView file

Lines 7-47javascript

7} from "./chunk-MEPHGCPQ.js";

8import "./chunk-ILR7GF3W.js";

9import "./chunk-BUDM6ULT.js";

10import "./chunk-MOL7MDBG.js";

11import {

12 toArrayBuffer

13} from "./chunk-7Z43WEML.js";

15// src/watch.ts

16import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

17import { basename, resolve, extname, sep } from "path";

18var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

19var DEBOUNCE_MS = 1e3;

20var STABLE_CHECK_MS = 300;

21var MAX_FILE_SIZE = 500 * 1024 * 1024;

22async function watchDirectory(options) {

23 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

24 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

25 if (webhook) validateWebhookUrl(webhook);

26 if (outDir) mkdirSync(outDir, { recursive: true });

27 const log = silent ? () => {

28 } : (msg) => process.stderr.write(msg + "\n");

29 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-Y7BAYXJE.jsView on unpkg · L27

30 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

31 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

32 const pending = /* @__PURE__ */ new Map();

33 const MAX_CONCURRENT = 3;

34 let activeCount = 0;

35 const inProgress = /* @__PURE__ */ new Set();

36 const waitForStableSize = async (absPath) => {

37 let prevSize = statSync(absPath).size;

38 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

39 if (!existsSync(absPath)) return 0;

40 const currSize = statSync(absPath).size;

41 if (currSize !== prevSize) {

42 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

43 if (!existsSync(absPath)) return 0;

44 return statSync(absPath).size;

45 }

46 return currSize;

47 };

dist/chunk-RUYSNNYZ.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-RUYSNNYZ.jsView on unpkg