registry / kordoc / 3.8.1

kordoc@3.8.1

⚠ Under review

Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff & print renderer

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 2.22 MB of source, external domains: github.com, huggingface.co, www.hancom.co.kr, www.idpf.org

Source & flagged code

2 flagged

dist/watch-MAWCDNFI.jsView file

Lines 5-45javascript

5import {

6 detectFormat

7} from "./chunk-MEPHGCPQ.js";

8import {

9 toArrayBuffer

10} from "./chunk-IFYJFWD2.js";

11import "./chunk-MOL7MDBG.js";

13// src/watch.ts

14import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

15import { basename, resolve, extname, sep } from "path";

16var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

17var DEBOUNCE_MS = 1e3;

18var STABLE_CHECK_MS = 300;

19var MAX_FILE_SIZE = 500 * 1024 * 1024;

20async function watchDirectory(options) {

21 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

22 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

23 if (webhook) validateWebhookUrl(webhook);

24 if (outDir) mkdirSync(outDir, { recursive: true });

25 const log = silent ? () => {

26 } : (msg) => process.stderr.write(msg + "\n");

27 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-MAWCDNFI.jsView on unpkg · L25

28 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

29 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

30 const pending = /* @__PURE__ */ new Map();

31 const MAX_CONCURRENT = 3;

32 let activeCount = 0;

33 const inProgress = /* @__PURE__ */ new Set();

34 const waitForStableSize = async (absPath) => {

35 let prevSize = statSync(absPath).size;

36 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

37 if (!existsSync(absPath)) return 0;

38 const currSize = statSync(absPath).size;

39 if (currSize !== prevSize) {

40 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

41 if (!existsSync(absPath)) return 0;

42 return statSync(absPath).size;

43 }

44 return currSize;

45 };

dist/chunk-KT2BCHXI.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kordoc@3.7.0 matchedIdentity = npm:a29yZG9j:3.7.0 similarity = 0.793 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-KT2BCHXI.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/watch-MAWCDNFI.jsView file

25const log = silent ? () => { L26: } : (msg) => process.stderr.write(msg + "\n"); L27: log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`); ... L135: validateWebhookUrl(url); L136: await fetch(url, { L137: method: "POST",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-MAWCDNFI.jsView on unpkg · L25

dist/chunk-KT2BCHXI.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-KT2BCHXI.jsView on unpkg

Findings

1 Critical1 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/chunk-KT2BCHXI.js

HighCloud Metadata Accessdist/watch-MAWCDNFI.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/watch-MAWCDNFI.jsView file

Lines 5-45javascript

5import {

6 detectFormat

7} from "./chunk-MEPHGCPQ.js";

8import {

9 toArrayBuffer

10} from "./chunk-IFYJFWD2.js";

11import "./chunk-MOL7MDBG.js";

13// src/watch.ts

14import { watch, readFileSync, writeFileSync, mkdirSync, statSync, existsSync, realpathSync } from "fs";

15import { basename, resolve, extname, sep } from "path";

16var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".hwp", ".hwpx", ".pdf", ".xlsx", ".docx"]);

17var DEBOUNCE_MS = 1e3;

18var STABLE_CHECK_MS = 300;

19var MAX_FILE_SIZE = 500 * 1024 * 1024;

20async function watchDirectory(options) {

21 const { dir, outDir, webhook, format = "markdown", pages, silent } = options;

22 if (!existsSync(dir)) throw new Error(`\uB514\uB809\uD1A0\uB9AC\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${dir}`);

23 if (webhook) validateWebhookUrl(webhook);

24 if (outDir) mkdirSync(outDir, { recursive: true });

25 const log = silent ? () => {

26 } : (msg) => process.stderr.write(msg + "\n");

27 log(`[kordoc watch] \uAC10\uC2DC \uC2DC\uC791: ${resolve(dir)}`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/watch-MAWCDNFI.jsView on unpkg · L25

28 if (outDir) log(`[kordoc watch] \uCD9C\uB825: ${resolve(outDir)}`);

29 if (webhook) log(`[kordoc watch] \uC6F9\uD6C5: ${webhook}`);

30 const pending = /* @__PURE__ */ new Map();

31 const MAX_CONCURRENT = 3;

32 let activeCount = 0;

33 const inProgress = /* @__PURE__ */ new Set();

34 const waitForStableSize = async (absPath) => {

35 let prevSize = statSync(absPath).size;

36 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

37 if (!existsSync(absPath)) return 0;

38 const currSize = statSync(absPath).size;

39 if (currSize !== prevSize) {

40 await new Promise((r) => setTimeout(r, STABLE_CHECK_MS));

41 if (!existsSync(absPath)) return 0;

42 return statSync(absPath).size;

43 }

44 return currSize;

45 };

dist/chunk-KT2BCHXI.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-KT2BCHXI.jsView on unpkg