q-koa@13.6.4
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcecore/file/plugins/common/controller.jsView file
184patternName = generic_password
severity = medium
line = 184
matchedText = password...hb',
Medium
Secret Pattern
Package contains a possible secret pattern.
core/file/plugins/common/controller.jsView on unpkg · L18415const OSS = require('ali-oss')
L16: const axios = require('axios')
L17: const util = require('util')
...
L58:
L59: const imgData = Buffer.from(reader).toString('base64')
L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串
L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}`
...
L64: const targetPath = `${path.resolve(
L65: __dirname,
L66: `${process.cwd()}/public/upload`
Low
Weak Crypto
Package source references weak cryptographic algorithms.
core/file/plugins/common/controller.jsView on unpkg · L15core/file/plugins/system/service.jsView file
2const { formatLiteralObj, filterFunction } = require('../../utils')
L3: const formatPostFunction = (str) => `eval(${str})`
L4: const nodeVm = require('vm')
L5: const axios = require('axios')
L6: const runVm = (_str) => {
...
L48: return axios
L49: .post(url, {
L50: ...data,
...
L106: if (!Array.isArray(postInclude(app))) {
L107: if (process.env.NODE_ENV !== 'production') {
L108: throw new Error(`${url} 返回 include检测是否数组`)
Findings
9 Medium6 Low
MediumSecret Patterncore/file/plugins/common/controller.js
MediumDynamic Requirecore/file/plugins/role_permission/controller.js
MediumUnsafe Vm Contextcore/file/plugins/system/service.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercore/restc/faas/install_production.sh
MediumStructural Risk Force Deep Review
MediumSecret Patterncore/file/plugins/administrator/controller.js
MediumSecret Patterncore/config.js
LowScripts Present
LowEvalcore/file/plugins/system/service.js
LowWeak Cryptocore/file/plugins/common/controller.js
LowFilesystem
Low
Affected versions and remediation
This report applies to q-koa@13.6.4.
See all versions of q-koa for other recorded verdicts.
- Review the evidence and your use of q-koa@13.6.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.