registry / kordoc / 3.16.0

kordoc@3.16.0

Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff, print & layout-preserving SVG renderer

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 2.56 MB of source, external domains: github.com, huggingface.co, schemas.openxmlformats.org, www.hancom.co.kr, www.idpf.org, www.w3.org

Source & flagged code

2 flagged

dist/watch-HIYNOSFD.jsView file

Lines 9-49javascript

9import "./chunk-MOL7MDBG.js";

10import "./chunk-FGL7BH4P.js";

11import "./chunk-5RHRQ7HK.js";

12import "./chunk-JFNWJFKP.js";

13import {

14 toArrayBuffer

15} from "./chunk-IC56KHBL.js";

17// src/watch.ts

18import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

19import { basename, resolve, extname, sep } from "path";

20var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

21var DEBOUNCE_MS = 1e3;

22var STABLE_CHECK_MS = 300;

23var MAX_FILE_SIZE = 500 * 1024 * 1024;

24async function watchDirectory(options) {

25 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

26 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

27 if (webhook) validateWebhookUrl(webhook);

28 if (outDir) mkdirSync(outDir, { recursive: true });

29 const log = silent ? () => {

30 } : (msg) => process.stderr.write(msg + "\n");

31 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-HIYNOSFD.jsView on unpkg · L29

32 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

33 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

34 const pending = /* @__PURE__ */ new Map();

35 const MAX_CONCURRENT = 3;

36 let activeCount = 0;

37 const inProgress = /* @__PURE__ */ new Set();

38 const waitForStableSize = async (absPath) => {

39 let prevSize = statSync(absPath).size;

40 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

41 if (!existsSync(absPath)) return 0;

42 const currSize = statSync(absPath).size;

43 if (currSize !== prevSize) {

44 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

45 if (!existsSync(absPath)) return 0;

46 return statSync(absPath).size;

47 }

48 return currSize;

49 };

dist/chunk-WD5NUUU6.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kordoc@3.12.0 matchedIdentity = npm:a29yZG9j:3.12.0 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-WD5NUUU6.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/watch-HIYNOSFD.jsView file

29const log = silent ? () => { L30: } : (msg) => process.stderr.write(msg + "\n"); L31: log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`); ... L139: validateWebhookUrl(url); L140: await fetch(url, { L141: method: "POST",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-HIYNOSFD.jsView on unpkg · L29

dist/chunk-WD5NUUU6.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-WD5NUUU6.jsView on unpkg

Findings

2 High3 Medium5 Low

HighCloud Metadata Accessdist/watch-HIYNOSFD.js

HighPrevious Version Dangerous Deltadist/chunk-WD5NUUU6.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/watch-HIYNOSFD.jsView file

Lines 9-49javascript

9import "./chunk-MOL7MDBG.js";

10import "./chunk-FGL7BH4P.js";

11import "./chunk-5RHRQ7HK.js";

12import "./chunk-JFNWJFKP.js";

13import {

14 toArrayBuffer

15} from "./chunk-IC56KHBL.js";

17// src/watch.ts

18import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

19import { basename, resolve, extname, sep } from "path";

20var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

21var DEBOUNCE_MS = 1e3;

22var STABLE_CHECK_MS = 300;

23var MAX_FILE_SIZE = 500 * 1024 * 1024;

24async function watchDirectory(options) {

25 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

26 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

27 if (webhook) validateWebhookUrl(webhook);

28 if (outDir) mkdirSync(outDir, { recursive: true });

29 const log = silent ? () => {

30 } : (msg) => process.stderr.write(msg + "\n");

31 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-HIYNOSFD.jsView on unpkg · L29

32 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

33 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

34 const pending = /* @__PURE__ */ new Map();

35 const MAX_CONCURRENT = 3;

36 let activeCount = 0;

37 const inProgress = /* @__PURE__ */ new Set();

38 const waitForStableSize = async (absPath) => {

39 let prevSize = statSync(absPath).size;

40 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

41 if (!existsSync(absPath)) return 0;

42 const currSize = statSync(absPath).size;

43 if (currSize !== prevSize) {

44 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

45 if (!existsSync(absPath)) return 0;

46 return statSync(absPath).size;

47 }

48 return currSize;

49 };

dist/chunk-WD5NUUU6.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-WD5NUUU6.jsView on unpkg