registry / q-koa / 13.6.3

q-koa@13.6.3

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 492 KB of source, external domains: api.day.app, api.kuashou.com, api.weixin.qq.com, apis.map.qq.com, businesscard.sinosecu.com.cn, compserviceplat.shenzhenbenwo.com, cus.allinpay.com, dashscope.aliyuncs.com, developer.toutiao.com, doudou.kuashou.com, dysmsapi.aliyuncs.com, h5vv.video.qq.com, lanhu.oss-cn-beijing.aliyuncs.com, misc.360buyimg.com, open.douyin.com, open.weixin.qq.com, openapi.alipay.com, openapi.alipaydev.com, puui.qpic.cn, restapi.amap.com, syb-test.allinpay.com, ugcbsy.qq.com, vsp.allinpay.com, wuliu.market.alicloudapi.com, www.baidu.com, www.kuashou.com, www.test.com, wxdy.592web.com, your-domain.com

Source & flagged code

9 flagged

core/file/plugins/common/controller.jsView file

184patternName = generic_password severity = medium line = 184 matchedText = password...hb',

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

15const OSS = require('ali-oss') L16: const axios = require('axios') L17: const util = require('util') ... L58: L59: const imgData = Buffer.from(reader).toString('base64') L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串 L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}` ... L64: const targetPath = `${path.resolve( L65: __dirname, L66: `${process.cwd()}/public/upload`

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

core/file/plugins/system/service.jsView file

2const { formatLiteralObj, filterFunction } = require('../../utils') L3: const formatPostFunction = (str) => `eval(${str})` L4: const nodeVm = require('vm') L5: const axios = require('axios') L6: const runVm = (_str) => { ... L48: return axios L49: .post(url, { L50: ...data, ... L106: if (!Array.isArray(postInclude(app))) { L107: if (process.env.NODE_ENV !== 'production') { L108: throw new Error(`${url} 返回 include检测是否数组`)

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

core/file/plugins/system/service.jsView on unpkg · L2

2const { formatLiteralObj, filterFunction } = require('../../utils') L3: const formatPostFunction = (str) => `eval(${str})` L4: const nodeVm = require('vm')

Low

Eval

Package source references a known benign dynamic code generation pattern.

core/file/plugins/system/service.jsView on unpkg · L2

core/file/plugins/role_permission/controller.jsView file

1const { getAppByCtx } = require('q-koa') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/file/plugins/role_permission/controller.jsView on unpkg · L1

core/restc/faas/install_production.shView file

•path = core/restc/faas/install_production.sh kind = build_helper sizeBytes = 336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/restc/faas/install_production.shView on unpkg

core/app.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = q-koa@13.6.2 matchedIdentity = npm:cS1rb2E:13.6.2 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/app.jsView on unpkg

core/file/plugins/administrator/controller.jsView file

6patternName = generic_password severity = medium line = 6 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in core/file/plugins/administrator/controller.js

core/file/plugins/administrator/controller.jsView on unpkg · L6

core/config.jsView file

86patternName = generic_password severity = medium line = 86 matchedText = password...bc',

Medium

Secret Pattern

Hardcoded password in core/config.js

core/config.jsView on unpkg · L86

Source & flagged code

9 flagged · loading source

core/file/plugins/common/controller.jsView file

184patternName = generic_password severity = medium line = 184 matchedText = password...hb',

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

core/file/plugins/system/service.jsView file

Findings

1 High9 Medium6 Low

HighPrevious Version Dangerous Deltacore/app.js

MediumSecret Patterncore/file/plugins/common/controller.js

MediumDynamic Requirecore/file/plugins/role_permission/controller.js

MediumUnsafe Vm Contextcore/file/plugins/system/service.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/restc/faas/install_production.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterncore/file/plugins/administrator/controller.js

MediumSecret Patterncore/config.js

LowScripts Present

LowEvalcore/file/plugins/system/service.js

LowWeak Cryptocore/file/plugins/common/controller.js

Affected versions and remediation

This report applies to q-koa@13.6.3.

See all versions of q-koa for other recorded verdicts.

Review the evidence and your use of q-koa@13.6.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-10 14:22:39.280Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.