q-koa@13.8.20
AI Security Review
scanned 27d ago · by lpm-firewall-aiq-koa 13.8.20 is an application framework whose default request path trusts a client header and substring whitelist, then evaluates caller-supplied include, relate, and websocket text. That is a critical remote code execution flaw in normal server use, but the package has no install lifecycle or hidden exfiltration chain, so it should be warned rather than blocked as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
A running server receives a request with Client-Type 0, or a path containing find or system, carrying an include or relate string, or a websocket message to onlineChat.
Impact
A remote caller can execute code in the Node process that serves the app, with access to the application environment. No install-time mutation or secret upload was found.
Mechanism
Auth middleware calls next when the header client type is 0 or the URL contains a default whitelist fragment. Query code then builds eval(request string) and executes it with runInNewContext. onlineChat constructs a vm2 VM and runs the websocket message with axios in the sandbox.
AI rationale
q-koa 13.8.20 is an application framework whose default request path trusts a client header and substring whitelist, then evaluates caller-supplied include, relate, and websocket text. That is a critical remote code execution flaw in normal server use, but the package has no install lifecycle or hidden exfiltration chain, so it should be warned rather than blocked as malware.
Evidence
core/app.jscore/file/plugins/system/controller.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- Default auth middleware accepts any request whose Client-Type header is 0, whose method is GET, or whose path merely contains a whitelist substring, and then continues without a valid JWT.
- The shipped whitelist includes the substring find, so ordinary findAll and findOne routes match url.includes and skip login.
- Those query handlers wrap the caller-supplied include and relate body fields as eval(...) and run them with Node vm.runInNewContext.
- The system onlineChat handler feeds each websocket message into vm2 with axios in the sandbox, and the default whitelist also contains the substring system.
- package.json has no preinstall, install, or postinstall hook; the risky paths run only after the application server is started.
Evidence against
- There is no import-time or install-time payload, no hidden credential collector, and no self-install of another release.
- The hardcoded sandbox export does not read request code; the live eval paths are request handlers of this Koa admin framework.
Behavioral surface
Crypto
Source & flagged code
7 flagged · loading sourcecore/file/plugins/common/controller.jsView file
184patternName = generic_password
severity = medium
line = 184
Medium
Secret Pattern
Package contains a possible secret pattern.
core/file/plugins/common/controller.jsView on unpkg · L18415const OSS = require('ali-oss')
L16: const axios = require('axios')
L17: const util = require('util')
...
L58:
L59: const imgData = Buffer.from(reader).toString('base64')
L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串
L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}`
...
L64: const targetPath = `${path.resolve(
L65: __dirname,
L66: `${process.cwd()}/public/upload`
Low
Weak Crypto
Package source references weak cryptographic algorithms.
core/file/plugins/common/controller.jsView on unpkg · L15core/file/plugins/role_permission/controller.jsView file
1const { getAppByCtx } = require('q-koa')
L2:
Findings
9 Medium5 Low
MediumSecret Patterncore/file/plugins/common/controller.js
MediumDynamic Requirecore/file/plugins/role_permission/controller.js
MediumUnsafe Vm Contextcore/file/plugins/system/service.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercore/restc/faas/install_production.sh
MediumStructural Risk Force Deep Review
MediumSecret Patterncore/file/plugins/administrator/controller.js
MediumSecret Patterncore/config.js
LowScripts Present
LowWeak Cryptocore/file/plugins/common/controller.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to q-koa@13.8.20.
See all versions of q-koa for other recorded verdicts.
- Review the evidence and your use of q-koa@13.8.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.