registry / q-koa / 13.8.10

q-koa@13.8.10

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 491 KB of source, external domains: api.day.app, api.kuashou.com, api.weixin.qq.com, apis.map.qq.com, businesscard.sinosecu.com.cn, compserviceplat.shenzhenbenwo.com, cus.allinpay.com, dashscope.aliyuncs.com, developer.toutiao.com, doudou.kuashou.com, dysmsapi.aliyuncs.com, h5vv.video.qq.com, lanhu.oss-cn-beijing.aliyuncs.com, misc.360buyimg.com, open.douyin.com, open.weixin.qq.com, openapi.alipay.com, openapi.alipaydev.com, puui.qpic.cn, restapi.amap.com, syb-test.allinpay.com, ugcbsy.qq.com, vsp.allinpay.com, wuliu.market.alicloudapi.com, www.baidu.com, www.kuashou.com, www.test.com, wxdy.592web.com, your-domain.com

Source & flagged code

9 flagged

core/file/plugins/common/controller.jsView file

Lines 1-35javascript

1const fs = require('fs')

2const fsPromise = require('fs/promises')

3const path = require('path')

4const crypto = require('crypto')

5const {

6 Random,

7 lodash,

8 getAppByCtx,

9 getConfig,

10 ServiceError,

11 sleep,

12} = require('q-koa')

13const Captchapng = require('captchapng')

14const qr = require('qr-image')

15const OSS = require('ali-oss')

16const axios = require('axios')

17const util = require('util')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

18const jwt = require('jsonwebtoken')

19const pm2 = require('pm2')

21const { getImageType } = require('../../utils')

22const Email = require('../../services/email')

23const Geo = require('../../services/geo')

24const Express = require('../../services/express')

26const annotationsReg = /(?:^|\n|\r)\s*\/\*[\s\S]*?\*\/\s*(?:\r|\n|$)/g

27const apiReg = /@api(Name|Desc|Param|Route|Return)(\s+)(.*)\n/g

29/**

30 * @apiRoute upload

31 * @apiName 上传

32 * @apiParam subject/string/付款名称

33 * @apiParam total_fee/string/支付金额

34 * @apiReturn {url}

35 */

Lines 164-204javascript

164 throw new Error(result.res.statusMessage)

165 }

166}

167

168exports.captcha = async (ctx) => {

169 const number

•matchType = previous_version_dangerous_delta matchedPackage = q-koa@13.8.6 matchedIdentity = npm:cS1rb2E:13.8.6 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/file/plugins/common/controller.jsView on unpkg

core/file/plugins/system/service.jsView file

2const { formatLiteralObj, filterFunction } = require('../../utils') L3: const formatPostFunction = (str) => `eval(${str})` L4: const nodeVm = require('vm') L5: const axios = require('axios') L6: const runVm = (_str) => { ... L48: return axios L49: .post(url, { L50: ...data, ... L106: if (!Array.isArray(postInclude(app))) { L107: if (process.env.NODE_ENV !== 'production') { L108: throw new Error(`${url} 返回 include检测是否数组`)

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

core/file/plugins/system/service.jsView on unpkg · L2

2const { formatLiteralObj, filterFunction } = require('../../utils') L3: const formatPostFunction = (str) => `eval(${str})` L4: const nodeVm = require('vm')

Low

Eval

Package source references a known benign dynamic code generation pattern.

core/file/plugins/system/service.jsView on unpkg · L2

core/file/plugins/role_permission/controller.jsView file

1const { getAppByCtx } = require('q-koa') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/file/plugins/role_permission/controller.jsView on unpkg · L1

core/restc/faas/install_production.shView file

•path = core/restc/faas/install_production.sh kind = build_helper sizeBytes = 336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/restc/faas/install_production.shView on unpkg

core/file/plugins/administrator/controller.jsView file

Lines 1-26javascript

1const { getAppByCtx } = require('q-koa')

2const md5 = require('js-md5')

4const superAdmin

core/config.jsView file

86patternName = generic_password severity = medium line = 86 matchedText = password...bc',

Medium

Secret Pattern

Hardcoded password in core/config.js

core/config.jsView on unpkg · L86

Source & flagged code

9 flagged · loading source

core/file/plugins/common/controller.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/file/plugins/common/controller.jsView on unpkg

184patternName = generic_password severity = medium line = 184 matchedText = password...hb',

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

15const OSS = require('ali-oss') L16: const axios = require('axios') L17: const util = require('util') ... L58: L59: const imgData = Buffer.from(reader).toString('base64') L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串 L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}` ... L64: const targetPath = `${path.resolve( L65: __dirname, L66: `${process.cwd()}/public/upload`

Low

Findings

1 High9 Medium6 Low

HighPrevious Version Dangerous Deltacore/file/plugins/common/controller.js

MediumSecret Patterncore/file/plugins/common/controller.js

MediumDynamic Requirecore/file/plugins/role_permission/controller.js

MediumUnsafe Vm Contextcore/file/plugins/system/service.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/restc/faas/install_production.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterncore/file/plugins/administrator/controller.js

MediumSecret Patterncore/config.js

LowScripts Present

LowEvalcore/file/plugins/system/service.js

LowWeak Crypto

Affected versions and remediation

This report applies to q-koa@13.8.10.

See all versions of q-koa for other recorded verdicts.

Review the evidence and your use of q-koa@13.8.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-13 11:57:15.683Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.