registry / kordoc / 3.16.2

kordoc@3.16.2

Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff, print & layout-preserving SVG renderer

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 2.58 MB of source, external domains: github.com, huggingface.co, schemas.openxmlformats.org, www.hancom.co.kr, www.idpf.org, www.w3.org

Source & flagged code

1 flagged

dist/watch-WLI6K3IR.jsView file

Lines 9-49javascript

9import "./chunk-MOL7MDBG.js";

10import "./chunk-WR5LHRXO.js";

11import "./chunk-E4Y73XRH.js";

12import "./chunk-HECUYZZK.js";

13import {

14 toArrayBuffer

15} from "./chunk-4WI7QXEG.js";

17// src/watch.ts

18import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

19import { basename, resolve, extname, sep } from "path";

20var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

21var DEBOUNCE_MS = 1e3;

22var STABLE_CHECK_MS = 300;

23var MAX_FILE_SIZE = 500 * 1024 * 1024;

24async function watchDirectory(options) {

25 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

26 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

27 if (webhook) validateWebhookUrl(webhook);

28 if (outDir) mkdirSync(outDir, { recursive: true });

29 const log = silent ? () => {

30 } : (msg) => process.stderr.write(msg + "\n");

31 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-WLI6K3IR.jsView on unpkg · L29

32 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

33 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

34 const pending = /* @__PURE__ */ new Map();

35 const MAX_CONCURRENT = 3;

36 let activeCount = 0;

37 const inProgress = /* @__PURE__ */ new Set();

38 const waitForStableSize = async (absPath) => {

39 let prevSize = statSync(absPath).size;

40 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

41 if (!existsSync(absPath)) return 0;

42 const currSize = statSync(absPath).size;

43 if (currSize !== prevSize) {

44 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

45 if (!existsSync(absPath)) return 0;

46 return statSync(absPath).size;

47 }

48 return currSize;

49 };

Source & flagged code

1 flagged · loading source

dist/watch-WLI6K3IR.jsView file

29const log = silent ? () => { L30: } : (msg) => process.stderr.write(msg + "\n"); L31: log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`); ... L139: validateWebhookUrl(url); L140: await fetch(url, { L141: method: "POST",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-WLI6K3IR.jsView on unpkg · L29

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/watch-WLI6K3IR.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/watch-WLI6K3IR.jsView file

Lines 9-49javascript

9import "./chunk-MOL7MDBG.js";

10import "./chunk-WR5LHRXO.js";

11import "./chunk-E4Y73XRH.js";

12import "./chunk-HECUYZZK.js";

13import {

14 toArrayBuffer

15} from "./chunk-4WI7QXEG.js";

17// src/watch.ts

18import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

19import { basename, resolve, extname, sep } from "path";

20var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

21var DEBOUNCE_MS = 1e3;

22var STABLE_CHECK_MS = 300;

23var MAX_FILE_SIZE = 500 * 1024 * 1024;

24async function watchDirectory(options) {

25 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

26 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

27 if (webhook) validateWebhookUrl(webhook);

28 if (outDir) mkdirSync(outDir, { recursive: true });

29 const log = silent ? () => {

30 } : (msg) => process.stderr.write(msg + "\n");

31 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-WLI6K3IR.jsView on unpkg · L29

32 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

33 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

34 const pending = /* @__PURE__ */ new Map();

35 const MAX_CONCURRENT = 3;

36 let activeCount = 0;

37 const inProgress = /* @__PURE__ */ new Set();

38 const waitForStableSize = async (absPath) => {

39 let prevSize = statSync(absPath).size;

40 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

41 if (!existsSync(absPath)) return 0;

42 const currSize = statSync(absPath).size;

43 if (currSize !== prevSize) {

44 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

45 if (!existsSync(absPath)) return 0;

46 return statSync(absPath).size;

47 }

48 return currSize;

49 };