registry / node-red-contrib-knx-ultimate / 5.0.1

node-red-contrib-knx-ultimate@5.0.1

Control your KNX and KNX Secure intallation via Node-Red! A bunch of KNX nodes, with integrated Philips HUE control, ETS group address importer, KNX AI for diagnosticsand KNX routing between interfaces. Easy to use and highly configurable.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 2.16 MB of source, external domains: api.anthropic.com, api.openai.com, cdnjs.cloudflare.com, discovery.meethue.com, github.com, ka-f.fontawesome.com, kit.fontawesome.com, knx.org, supergiovane.github.io, www.loxone.com, www.w3.org

Source & flagged code

5 flagged

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView file

Lines 1-6javascript

1import{_ as Va}from"./chunk-jspdf.es.min.js";import"./app.js";var La=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function il(n){return n&&n.__esModule&&Object.prototype.hasOwnProperty.call(n,"default")?n.default:n}var fn={},cn={},cr,vn;function Q(){if(vn)return cr;vn=1;var n=function(e){return e&&e.Math===Math&&e};return cr=n(typeof globalThis=="object"&&globalThis)||n(typeof window=="object"&&window)||n(typeof self=="object"&&self)||n(typeof La=="object"&&La)||n(typeof cr=="object"&&cr)||(function(){return this})()||Function("retu ...

2`)&&t.flags==="s")}),ia}var aa,Vo;function Vh(){if(Vo)return aa;Vo=1;var n=Z(),e=Q(),r=e.RegExp;return aa=n(function(){var t=r("(?<a>b)","g");return t.exec("b").groups.a!=="b"||"b".replace(t,"$<a>c")!=="bc"}),aa}var na,Lo;function rn(){if(Lo)return na;Lo=1;var n=se(),e=J(),r=qe(),t=wl(),i=Pl(),a=Ha(),s=Ur(),o=Lr().get,u=Dh(),l=Vh(),h=a("native-string-replace",String.prototype.replace),c=RegExp.prototype.exec,v=c,f=e("".charAt),g=e("".indexOf),d=e("".replace),p=e("".slice),y=(function(){var E=/a/,T=/b*/g;return n(c,E,"a"),n(c,T,"a"),E.lastIndex!==0||T.lastIndex!==0})(),m=i.BROKEN_CARET,b=/()??/ ...

3`&&U!=="\r"&&U!=="\u2028"&&U!=="\u2029")&&(j="(?: (?:"+j+"))",q=" "+q,_++),k=new RegExp("^(?:"+j+")",N)}b&&(k=new

4\v\f\r     　\u2028\u2029\uFEFF`),Aa}var Ia,Eu;function hf(){if(Eu)return Ia;Eu=1;var n=J(),e=Pe(),r=qe(),t=Ml(),i=n("".replace),a=RegExp("^["+t+"]+"),s=RegExp("(^|[^"+t+"])["+t+"]+$"),o=function(u){return function(l){var h=r(e(l));return u&1&&(h=i(h,a,"")),u&2&&(h=i(h,s,"$1")),h}};return Ia={start:o(1),end:o(2),trim:o(3)},Ia}var Na,Ru;function ff(){if(Ru)return Na;Ru=1;var n=Vr().PROPER,e=Z(),r=Ml(),t="᠎";return Na=function(i){return e(function(){return!!r[i]()||t[i]()!==t||n&&r[i].name!==i})},Na}var Cu;function cf(){if(Cu)return Tu;Cu=1;var n=fe(),e=hf().trim,r=ff();return n({tar ...

5`},Bu=function(n){return 48<=n.charCodeAt(0)&&n.charCodeAt(0)<=57},Of=(function(n){function e(){var r=n.call(this)||this;return

Long lines were clipped for display.

nodes/knxUltimateLoadControl.jsView file

Lines 43-83javascript

43 if (!status) return

44 const provider = node.serverKNX

45 if (provider && typeof provider.applyStatusUpdate === 'function') {

46 provider.applyStatusUpdate(node, status)

47 } else {

nodes/knxUltimateHueButton.jsView file

Lines 1-21javascript

1module.exports = function (RED) {

2 const dptlib = require('knxultimate').dptlib

Medium

Dynamic Require

Package source references dynamic require/import behavior.

nodes/knxUltimateHueButton.jsView on unpkg · L1

4 function knxUltimateHueButton (

nodes/knxUltimateAI.jsView file

Lines 1-25javascript

1// KNX Ultimate AI / Traffic Analyzer

2const loggerClass = require('./utils/sysLogger')

3const dptlib = require('knxultimate').dptlib

4const fs = require('fs')

5const

Source & flagged code

5 flagged · loading source

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView file

4\v\f\r     　\u2028\u2029\uFEFF`),Aa}var Ia,Eu;function hf(){if(Eu)return Ia;Eu=1;var n=J(),e=Pe(),r=qe(),t=Ml(),i=n("".replace),a=RegExp("^["+t+"]+"),s=RegExp("(^|[^"+t+... L5: `},Bu=function(n){return 48<=n.charCodeAt(0)&&n.charCodeAt(0)<=57},Of=(function(n){function e(){var r=n.call(this)||this;return r.curNumber="",r.curCommandType=-1,r.curCommandRelat...

High

Child Process

Package source references child process execution.

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView on unpkg · L4

nodes/knxUltimateLoadControl.jsView file

63node.deviceList.push({ L64: ga: eval('config.GA' + index), L65: dpt: eval('config.DPT' + index),

Low

Eval

Package source references a known benign dynamic code generation pattern.

nodes/knxUltimateLoadControl.jsView on unpkg · L63

nodes/knxUltimateHueButton.jsView file

1module.exports = function (RED) { L2: const dptlib = require('knxultimate').dptlib L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

nodes/knxUltimateHueButton.jsView on unpkg · L1

nodes/knxUltimateAI.jsView file

5Cross-file remote execution chain: nodes/knxUltimateAI.js spawns nodes/plugins/knxUltimateAI-vue/assets/app.js; helper contains network access plus dynamic code execution. L5: const path = require('path') L6: const { spawn } = require('child_process') L7: const { getRequestAccessToken, [redacted] } = require('./utils/httpAdminAccessToken') ... L18: const aiRuntimeNodes = new Map() L19: const knxAiVueDistDir = path.join(__dirname, 'plugins', 'knxUltimateAI-vue') L20: ... L30: { type: 'tab', paletteLabel: 'Flow tab (do not emit, added automatically)', category: 'config', inputs: 0, outputs: 0, fields: {} }, L31: { type: 'inject', paletteLabel: 'inject (manual/scheduled trigger)', category: 'common', inputs: 0, outputs: 1, fields: { name: {}, props: {}, repeat: {}, crontab: {}, once: {}, to... L32: { type: 'debug', paletteLabel: 'debug (sidebar log)', category: 'common', inputs: 1, outputs: 0, fields: { name: {}, active: {}, complete: {}, console: {}, tosidebar: {} } }, ... L173: try { L174: const pkg = require(path.join(__dirname, '..', 'package.json')) L175: nodeMap = (pkg['node-red'] && pkg['node-red'].nodes) || {}

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

nodes/knxUltimateAI.jsView on unpkg · L5

5const path = require('path') L6: const { spawn } = require('child_process') L7: const { getRequestAccessToken, [redacted] } = require('./utils/httpAdminAccessToken') ... L18: const aiRuntimeNodes = new Map() L19: const knxAiVueDistDir = path.join(__dirname, 'plugins', 'knxUltimateAI-vue') L20: ... L30: { type: 'tab', paletteLabel: 'Flow tab (do not emit, added automatically)', category: 'config', inputs: 0, outputs: 0, fields: {} }, L31: { type: 'inject', paletteLabel: 'inject (manual/scheduled trigger)', category: 'common', inputs: 0, outputs: 1, fields: { name: {}, props: {}, repeat: {}, crontab: {}, once: {}, to... L32: { type: 'debug', paletteLabel: 'debug (sidebar log)', category: 'common', inputs: 1, outputs: 0, fields: { name: {}, active: {}, complete: {}, console: {}, tosidebar: {} } }, ... L173: try { L174: const pkg = require(path.join(__dirname, '..', 'package.json')) L175: nodeMap = (pkg['node-red'] && pkg['node-red'].nodes) || {}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

nodes/knxUltimateAI.jsView on unpkg · L5

Findings

3 High4 Medium7 Low

HighChild Processnodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.js

HighShell

HighCross File Remote Execution Contextnodes/knxUltimateAI.js

MediumDynamic Requirenodes/knxUltimateHueButton.js

MediumNetwork

MediumInstall Persistencenodes/knxUltimateAI.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalnodes/knxUltimateLoadControl.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView file

Lines 1-6javascript

3`&&U!=="\r"&&U!=="\u2028"&&U!=="\u2029")&&(j="(?: (?:"+j+"))",q=" "+q,_++),k=new RegExp("^(?:"+j+")",N)}b&&(k=new

5`},Bu=function(n){return 48<=n.charCodeAt(0)&&n.charCodeAt(0)<=57},Of=(function(n){function e(){var r=n.call(this)||this;return

Long lines were clipped for display.

nodes/knxUltimateLoadControl.jsView file

Lines 43-83javascript

43 if (!status) return

44 const provider = node.serverKNX

45 if (provider && typeof provider.applyStatusUpdate === 'function') {

46 provider.applyStatusUpdate(node, status)

47 } else {

nodes/knxUltimateHueButton.jsView file

Lines 1-21javascript

1module.exports = function (RED) {

2 const dptlib = require('knxultimate').dptlib

Medium

Dynamic Require

Package source references dynamic require/import behavior.

nodes/knxUltimateHueButton.jsView on unpkg · L1

4 function knxUltimateHueButton (

nodes/knxUltimateAI.jsView file

Lines 1-25javascript

1// KNX Ultimate AI / Traffic Analyzer

2const loggerClass = require('./utils/sysLogger')

3const dptlib = require('knxultimate').dptlib

4const fs = require('fs')

5const