registry / q-koa / 13.8.5

q-koa@13.8.5

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 490 KB of source, external domains: api.day.app, api.kuashou.com, api.weixin.qq.com, apis.map.qq.com, businesscard.sinosecu.com.cn, compserviceplat.shenzhenbenwo.com, cus.allinpay.com, dashscope.aliyuncs.com, developer.toutiao.com, doudou.kuashou.com, dysmsapi.aliyuncs.com, h5vv.video.qq.com, lanhu.oss-cn-beijing.aliyuncs.com, misc.360buyimg.com, open.douyin.com, open.weixin.qq.com, openapi.alipay.com, openapi.alipaydev.com, puui.qpic.cn, restapi.amap.com, syb-test.allinpay.com, ugcbsy.qq.com, vsp.allinpay.com, wuliu.market.alicloudapi.com, www.baidu.com, www.kuashou.com, www.test.com, wxdy.592web.com, your-domain.com

Source & flagged code

9 flagged

core/file/plugins/common/controller.jsView file

Lines 1-35javascript

1const fs = require('fs')

2const fsPromise = require('fs/promises')

3const path = require('path')

4const crypto = require('crypto')

5const {

6 Random,

7 lodash,

8 getAppByCtx,

9 getConfig,

10 ServiceError,

11 sleep,

12} = require('q-koa')

13const Captchapng = require('captchapng')

14const qr = require('qr-image')

15const OSS = require('ali-oss')

16const axios = require('axios')

17const util = require('util')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

18const jwt = require('jsonwebtoken')

19const pm2 = require('pm2')

21const { getImageType } = require('../../utils')

22const Email = require('../../services/email')

23const Geo = require('../../services/geo')

24const Express = require('../../services/express')

26const annotationsReg = /(?:^|\n|\r)\s*\/\*[\s\S]*?\*\/\s*(?:\r|\n|$)/g

27const apiReg = /@api(Name|Desc|Param|Route|Return)(\s+)(.*)\n/g

29/**

30 * @apiRoute upload

31 * @apiName 上传

32 * @apiParam subject/string/付款名称

33 * @apiParam total_fee/string/支付金额

34 * @apiReturn {url}

35 */

Lines 164-204javascript

164 throw new Error(result.res.statusMessage)

165 }

166}

167

168exports.captcha = async (ctx) => {

169 const number

core/file/plugins/system/service.jsView file

Lines 1-22javascript

1const { getConfig, lodash, Sequelize } = require('q-koa')

2const { formatLiteralObj, filterFunction } = require('../../utils')

core/file/plugins/role_permission/controller.jsView file

Lines 1-21javascript

1const { getAppByCtx } = require('q-koa')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/file/plugins/role_permission/controller.jsView on unpkg · L1

3exports.edit = async (ctx

core/restc/faas/install_production.shView file

•path = core/restc/faas/install_production.sh kind = build_helper sizeBytes = 336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/restc/faas/install_production.shView on unpkg

core/app.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = q-koa@13.8.3 matchedIdentity = npm:cS1rb2E:13.8.3 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/app.jsView on unpkg

core/file/plugins/administrator/controller.jsView file

Lines 1-26javascript

1const { getAppByCtx } = require('q-koa')

2const md5 = require('js-md5')

4const superAdmin

core/config.jsView file

Lines 66-106javascript

66 'common/getLngAndLat',

67 'weixin/mp_login',

68 'log/create',

69 'log/upsert',

70 'auto/minute',

71 'auto/second',

72 ].every

Source & flagged code

9 flagged · loading source

core/file/plugins/common/controller.jsView file

184patternName = generic_password severity = medium line = 184 matchedText = password...hb',

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

15const OSS = require('ali-oss') L16: const axios = require('axios') L17: const util = require('util') ... L58: L59: const imgData = Buffer.from(reader).toString('base64') L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串 L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}` ... L64: const targetPath = `${path.resolve( L65: __dirname, L66: `${process.cwd()}/public/upload`

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

core/file/plugins/system/service.jsView file

2const { formatLiteralObj, filterFunction } = require('../../utils') L3: const formatPostFunction = (str) => `eval(${str})` L4: const nodeVm = require('vm') L5: const axios = require('axios') L6: const runVm = (_str) => { ... L48: return axios L49: .post(url, { L50: ...data, ... L106: if (!Array.isArray(postInclude(app))) { L107: if (process.env.NODE_ENV !== 'production') { L108: throw new Error(`${url} 返回 include检测是否数组`)

Findings

1 High9 Medium6 Low

HighPrevious Version Dangerous Deltacore/app.js

MediumSecret Patterncore/file/plugins/common/controller.js

MediumDynamic Requirecore/file/plugins/role_permission/controller.js

MediumUnsafe Vm Contextcore/file/plugins/system/service.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/restc/faas/install_production.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterncore/file/plugins/administrator/controller.js

MediumSecret Patterncore/config.js

LowScripts Present

LowEvalcore/file/plugins/system/service.js

LowWeak Cryptocore/file/plugins/common/controller.js

Affected versions and remediation

This report applies to q-koa@13.8.5.

See all versions of q-koa for other recorded verdicts.

Review the evidence and your use of q-koa@13.8.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-12 14:20:01.677Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.