registry / node-red-contrib-knx-ultimate / 6.0.5

node-red-contrib-knx-ultimate@6.0.5

Control your KNX and KNX Secure intallation via Node-Red! A bunch of KNX nodes, with integrated Philips HUE control, ETS group address importer, KNX AI for diagnosticsand KNX routing between interfaces. Easy to use and highly configurable.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 2.41 MB of source, external domains: api.anthropic.com, api.openai.com, cdnjs.cloudflare.com, discovery.meethue.com, github.com, ka-f.fontawesome.com, kit.fontawesome.com, knx.org, supergiovane.github.io, www.loxone.com, www.w3.org

Source & flagged code

5 flagged

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView file

Lines 1-6javascript

1import{_ as Va}from"./chunk-jspdf.es.min.js";import"./app.js";var La=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self

Source & flagged code

5 flagged · loading source

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView file

4\v\f\r     　\u2028\u2029\uFEFF`),Aa}var Ia,Eu;function hf(){if(Eu)return Ia;Eu=1;var n=J(),e=Pe(),r=qe(),t=Ml(),i=n("".replace),a=RegExp("^["+t+"]+"),s=RegExp("(^|[^"+t+... L5: `},Bu=function(n){return 48<=n.charCodeAt(0)&&n.charCodeAt(0)<=57},Of=(function(n){function e(){var r=n.call(this)||this;return r.curNumber="",r.curCommandType=-1,r.curCommandRelat...

High

Child Process

Package source references child process execution.

nodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.jsView on unpkg · L4

nodes/knxUltimateLoadControl.jsView file

63node.deviceList.push({ L64: ga: eval('config.GA' + index), L65: dpt: eval('config.DPT' + index),

Low

Eval

Package source references a known benign dynamic code generation pattern.

nodes/knxUltimateLoadControl.jsView on unpkg · L63

nodes/knxUltimateHueButton.jsView file

1module.exports = function (RED) { L2: const dptlib = require('knxultimate').dptlib L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

nodes/knxUltimateHueButton.jsView on unpkg · L1

nodes/knxUltimateAI.jsView file

5Cross-file remote execution chain: nodes/knxUltimateAI.js spawns nodes/plugins/knxUltimateAI-vue/assets/app.js; helper contains network access plus dynamic code execution. L5: const path = require('path') L6: const { spawn } = require('child_process') L7: const { getRequestAccessToken, [redacted] } = require('./utils/httpAdminAccessToken') ... L18: const aiRuntimeNodes = new Map() L19: const knxAiVueDistDir = path.join(__dirname, 'plugins', 'knxUltimateAI-vue') L20: ... L30: { type: 'tab', paletteLabel: 'Flow tab (do not emit, added automatically)', category: 'config', inputs: 0, outputs: 0, fields: {} }, L31: { type: 'inject', paletteLabel: 'inject (manual/scheduled trigger)', category: 'common', inputs: 0, outputs: 1, fields: { name: {}, props: {}, repeat: {}, crontab: {}, once: {}, to... L32: { type: 'debug', paletteLabel: 'debug (sidebar log)', category: 'common', inputs: 1, outputs: 0, fields: { name: {}, active: {}, complete: {}, console: {}, tosidebar: {} } }, ... L173: try { L174: const pkg = require(path.join(__dirname, '..', 'package.json')) L175: nodeMap = (pkg['node-red'] && pkg['node-red'].nodes) || {}

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

nodes/knxUltimateAI.jsView on unpkg · L5

5const path = require('path') L6: const { spawn } = require('child_process') L7: const { getRequestAccessToken, [redacted] } = require('./utils/httpAdminAccessToken') ... L18: const aiRuntimeNodes = new Map() L19: const knxAiVueDistDir = path.join(__dirname, 'plugins', 'knxUltimateAI-vue') L20: ... L30: { type: 'tab', paletteLabel: 'Flow tab (do not emit, added automatically)', category: 'config', inputs: 0, outputs: 0, fields: {} }, L31: { type: 'inject', paletteLabel: 'inject (manual/scheduled trigger)', category: 'common', inputs: 0, outputs: 1, fields: { name: {}, props: {}, repeat: {}, crontab: {}, once: {}, to... L32: { type: 'debug', paletteLabel: 'debug (sidebar log)', category: 'common', inputs: 1, outputs: 0, fields: { name: {}, active: {}, complete: {}, console: {}, tosidebar: {} } }, ... L173: try { L174: const pkg = require(path.join(__dirname, '..', 'package.json')) L175: nodeMap = (pkg['node-red'] && pkg['node-red'].nodes) || {}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

nodes/knxUltimateAI.jsView on unpkg · L5

Findings

3 High4 Medium7 Low

HighChild Processnodes/plugins/knxUltimateAI-vue/assets/chunk-index.es.js

HighShell

HighCross File Remote Execution Contextnodes/knxUltimateAI.js

MediumDynamic Requirenodes/knxUltimateHueButton.js

MediumNetwork

MediumInstall Persistencenodes/knxUltimateAI.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalnodes/knxUltimateLoadControl.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

nodes/knxUltimateLoadControl.jsView file

Lines 43-83javascript

43 if (!status) return

44 const provider = node.serverKNX

45 if (provider && typeof provider.applyStatusUpdate === 'function') {

46 provider.applyStatusUpdate(node, status)

47 } else {

48 node.status(status)

49 }

50 }

52 const updateStatus = (status) => {

53 if (!status) return

54 pushStatus(status)

55 }

56 try {

57 const baseLogLevel = (node.serverKNX && node.serverKNX.loglevel) ? node.serverKNX.loglevel : 'error'

58 node.sysLogger = new loggerClass({ loglevel: baseLogLevel, setPrefix: node.type + ' <' + (node.name || node.id || '') + '>' })

59 } catch (error) { console.log(error.stack) }

60 node.deviceList = []

61 for (let index = 1; index < 6; index++) {

62 // Eval, the magic. Fill in the device list. DEFINITION DEVICELIST

63 node.deviceList.push({

64 ga: eval('config.GA' + index),

65 dpt: eval('config.DPT' + index),

Low

Eval

Package source references a known benign dynamic code generation pattern.

nodes/knxUltimateLoadControl.jsView on unpkg · L63

66 name: eval('config.Name' + index),

67 autoRestore: eval('config.autoRestore' + index),

68 monitorGA: eval('config.MonitorGA' + index),

69 monitorDPT: eval('config.MonitorDPT' + index),

70 monitorName: eval('config.MonitorName' + index),

71 monitorVal: null

72 })

73 }

75 // Used to call the status update from the config node.

76 node.setNodeStatus = ({ fill, shape, text, payload, GA, dpt, devicename }) => {

77 if (node.serverKNX === null) return

78 // Log only service statuses, not the GA values

79 try {

80 if (dpt !== '') return

81 const dDate = new Date()

82 const ts = (node.serverKNX && typeof node.serverKNX.formatStatusTimestamp === 'function')

83 ? node.serverKNX.formatStatusTimestamp(dDate)

nodes/knxUltimateAI.jsView file

Lines 1-25javascript

1// KNX Ultimate AI / Traffic Analyzer

2const loggerClass = require('./utils/sysLogger')

3const dptlib = require('knxultimate').dptlib

4const fs = require('fs')

5const path = require('path')

6const { spawn } = require('child_process')

7const { getRequestAccessToken, normalizeAuthFromAccessTokenQuery } = require('./utils/httpAdminAccessToken')

8let googleTranslateTTS = null

9try {

10 googleTranslateTTS = require('google-translate-tts')

11} catch (error) {

12 googleTranslateTTS = null

13}

15const coerceBoolean = (value) => (value === true || value === 'true')

17let adminEndpointsRegistered = false

18const aiRuntimeNodes = new Map()

19const knxAiVueDistDir = path.join(__dirname, 'plugins', 'knxUltimateAI-vue')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

nodes/knxUltimateAI.jsView on unpkg · L5

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

nodes/knxUltimateAI.jsView on unpkg · L5

21// ---------------------------------------------------------------------------

22// KNX AI Flow Builder helpers

23// Build a node "catalog" (type + editable fields) from this package's own

24// editor .html files, so the LLM knows exactly which node types and config

25// fields it can emit when generating a Node-RED flow to paste in the editor.