q-koa@13.8.56
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a Koa CMS, not an install-time malware dropper, but the default router evaluates request-body include strings with Function and exposes raw SQL on an allowlisted common route. Those are critical runtime flaws, and the scanner's remote-response-to-eval label is a mismatch because axios results are stored as data.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The consumer starts the Koa app, then a client sends HTTP requests to those routes.
Impact
Remote code execution and arbitrary database queries on the host that runs this framework
Mechanism
Unauthenticated request-body code and SQL execution in the default router
AI rationale
This is a Koa CMS, not an install-time malware dropper, but the default router evaluates request-body include strings with Function and exposes raw SQL on an allowlisted common route. Those are critical runtime flaws, and the scanner's remote-response-to-eval label is a mismatch because axios results are stored as data.
Evidence
core/app.jscore/config.jscore/file/plugins/system/service.jscore/file/plugins/system/controller.jscore/file/plugins/common/controller.jscore/file/plugins/log/service.js
Network endpoints1
api.day.app
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The main router wraps request include and relate strings in eval and runs them with Function.
- Default JWT allowlists find, common, and system/initData, and GET requests skip token checks.
- The common/sql handler runs arbitrary SQL from the POST body.
- Unless the app overrides it, error logs are pushed to a hardcoded Bark host on api.day.app.
Evidence against
- package.json has no preinstall, install, or postinstall hooks; index.js only checks the Node version and exports the app class.
- The tree is a large Koa CMS with WeChat, Douyin, Alipay, and similar plugins; network hosts match those products.
- No child_process, obfuscation, or a package.json self-dependency that installs another q-koa release.
- Function/eval is used to build Sequelize include callbacks, matching nearby toFunction comments, not a hidden install payload.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
9 flagged · loading sourcecore/file/plugins/common/controller.jsView file
184patternName = generic_password
severity = medium
line = 184
Medium
Secret Pattern
Package contains a possible secret pattern.
core/file/plugins/common/controller.jsView on unpkg · L18415const OSS = require('ali-oss')
L16: const axios = require('axios')
L17: const util = require('util')
...
L58:
L59: const imgData = Buffer.from(reader).toString('base64')
L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串
L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}`
...
L64: const targetPath = `${path.resolve(
L65: __dirname,
L66: `${process.cwd()}/public/upload`
Low
Weak Crypto
Package source references weak cryptographic algorithms.
core/file/plugins/common/controller.jsView on unpkg · L15core/file/plugins/system/service.jsView file
3const { formatLiteralObj, filterFunction } = require('../../utils')
L4: const formatPostFunction = (str) => `eval(${str})`
L5: const axios = require('axios')
L6: const runVm = (_str) => {
...
L46: return axios
L47: .post(url, {
L48: ...data,
...
L104: if (!Array.isArray(postInclude(app))) {
L105: if (process.env.NODE_ENV !== 'production') {
L106: throw new Error(`${url} 返回 include检测是否数组`)
Findings
1 Critical2 High8 Medium5 Low
CriticalRemote Response Code Executioncore/file/plugins/system/service.js
HighEvalcore/file/plugins/system/service.js
HighPrevious Version Dangerous Deltacore/app.js
MediumSecret Patterncore/file/plugins/common/controller.js
MediumDynamic Requirecore/file/plugins/role_permission/controller.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercore/restc/faas/install_production.sh
MediumStructural Risk Force Deep Review
MediumSecret Patterncore/file/plugins/administrator/controller.js
MediumSecret Patterncore/config.js
LowScripts Present
Low
Affected versions and remediation
This report applies to q-koa@13.8.56.
See all versions of q-koa for other recorded verdicts.
- Review the evidence and your use of q-koa@13.8.56 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.