registry / Remote code execution / q-koa / 13.8.57

q-koa@13.8.57

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This release contains a concrete request-driven dynamic-code execution vulnerability, warranting a warning. The inspected source does not establish malware intent or an install-time compromise chain.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A caller with access to a system initData or generic read endpoint submits a crafted include or relate expression in the POST body.

Impact

An attacker able to reach the affected API with sufficient access could execute arbitrary JavaScript in the server process.

Mechanism

Request fields flow into formatPostFunction and then into new Function, which evaluates the constructed eval expression in the Node.js process.

AI rationale

This release contains a concrete request-driven dynamic-code execution vulnerability, warranting a warning. The inspected source does not establish malware intent or an install-time compromise chain.

Evidence

core/app.jscore/file/plugins/system/controller.jscore/file/plugins/system/service.js

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The package routes POST controller actions and passes request-body include expressions into a dynamic Function/eval execution path.
The system initData controller accepts caller-provided includes and forwards them to the service that evaluates include expressions.
The manifest has no automatic install lifecycle hook; its listed commands are manual debug, serve, and link commands.

Evidence against

No package-install hook, self-dependency, credential-harvesting logic, or package-controlled exfiltration endpoint was found in the inspected paths.
The observed issue is an exposed framework execution primitive, not evidence of covert malware behavior.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

core/file/plugins/common/controller.jsView file

Lines 1-35javascript

1const fs = require('fs')

2const fsPromise = require('fs/promises')

3const path = require('path')

4const crypto = require('crypto')

5const {

6 Random,

7 lodash,

8 getAppByCtx,

9 getConfig,

10 ServiceError,

11 sleep,

12} = require('q-koa')

13const Captchapng = require('captchapng')

14const qr = require('qr-image')

15const OSS = require('ali-oss')

16const axios = require('axios')

17const util = require('util')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

18const jwt = require('jsonwebtoken')

19const pm2 = require('pm2')

21const { getImageType } = require('../../utils')

22const Email = require('../../services/email')

23const Geo = require('../../services/geo')

24const Express = require('../../services/express')

26const annotationsReg = /(?:^|\n|\r)\s*\/\*[\s\S]*?\*\/\s*(?:\r|\n|$)/g

27const apiReg = /@api(Name|Desc|Param|Route|Return)(\s+)(.*)\n/g

29/**

30 * @apiRoute upload

31 * @apiName 上传

32 * @apiParam subject/string/付款名称

33 * @apiParam total_fee/string/支付金额

34 * @apiReturn {url}

35 */

Lines 164-204javascript

164 throw new Error(result.res.statusMessage)

165 }

166}

167

168exports.captcha = async (ctx) => {

169 const number

core/file/plugins/system/service.jsView file

Lines 1-23javascript

1const lodash = require('lodash')

2const { Sequelize } = require('q-koa')

3const { formatLiteralObj, filterFunction }

core/file/plugins/role_permission/controller.jsView file

Lines 1-21javascript

1const { getAppByCtx } = require('q-koa')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/file/plugins/role_permission/controller.jsView on unpkg · L1

3exports.edit = async (ctx

core/restc/faas/install_production.shView file

•path = core/restc/faas/install_production.sh kind = build_helper sizeBytes = 336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/restc/faas/install_production.shView on unpkg

core/app.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = q-koa@13.8.56 matchedIdentity = npm:cS1rb2E:13.8.56 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/app.jsView on unpkg

core/file/plugins/administrator/controller.jsView file

Lines 1-26javascript

1const { getAppByCtx } = require('q-koa')

2const md5 = require('js-md5')

4const superAdmin

core/config.jsView file

Lines 63-103javascript

63 'common/getLngAndLat',

64 'weixin/mp_login',

65 'log/create',

66 'log/upsert',

67 'auto/minute',

68 'auto/second',

69 ].every

Source & flagged code

9 flagged · loading source

core/file/plugins/common/controller.jsView file

184patternName = generic_password severity = medium line = 184

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

15const OSS = require('ali-oss') L16: const axios = require('axios') L17: const util = require('util') ... L58: L59: const imgData = Buffer.from(reader).toString('base64') L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串 L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}` ... L64: const targetPath = `${path.resolve( L65: __dirname, L66: `${process.cwd()}/public/upload`

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

core/file/plugins/system/service.jsView file

3const { formatLiteralObj, filterFunction } = require('../../utils') L4: const formatPostFunction = (str) => `eval(${str})` L5: const axios = require('axios') L6: const runVm = (_str) => { ... L46: return axios L47: .post(url, { L48: ...data, ... L104: if (!Array.isArray(postInclude(app))) { L105: if (process.env.NODE_ENV !== 'production') { L106: throw new Error(`${url} 返回 include检测是否数组`)

Findings

1 Critical2 High8 Medium5 Low

CriticalRemote Response Code Executioncore/file/plugins/system/service.js

HighEvalcore/file/plugins/system/service.js

HighPrevious Version Dangerous Deltacore/app.js

MediumSecret Patterncore/file/plugins/common/controller.js

MediumDynamic Requirecore/file/plugins/role_permission/controller.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/restc/faas/install_production.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterncore/file/plugins/administrator/controller.js

MediumSecret Patterncore/config.js

LowScripts Present

Low

Affected versions and remediation

This report applies to q-koa@13.8.57.

See all versions of q-koa for other recorded verdicts.

Review the evidence and your use of q-koa@13.8.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 07:32:15.802Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.