registry / q-koa / 13.8.6

q-koa@13.8.6

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 491 KB of source, external domains: api.day.app, api.kuashou.com, api.weixin.qq.com, apis.map.qq.com, businesscard.sinosecu.com.cn, compserviceplat.shenzhenbenwo.com, cus.allinpay.com, dashscope.aliyuncs.com, developer.toutiao.com, doudou.kuashou.com, dysmsapi.aliyuncs.com, h5vv.video.qq.com, lanhu.oss-cn-beijing.aliyuncs.com, misc.360buyimg.com, open.douyin.com, open.weixin.qq.com, openapi.alipay.com, openapi.alipaydev.com, puui.qpic.cn, restapi.amap.com, syb-test.allinpay.com, ugcbsy.qq.com, vsp.allinpay.com, wuliu.market.alicloudapi.com, www.baidu.com, www.kuashou.com, www.test.com, wxdy.592web.com, your-domain.com

Source & flagged code

9 flagged

core/file/plugins/common/controller.jsView file

184patternName = generic_password severity = medium line = 184 matchedText = password...hb',

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

15const OSS = require('ali-oss') L16: const axios = require('axios') L17: const util = require('util') ... L58: L59: const imgData = Buffer.from(reader).toString('base64') L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串 L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}` ... L64: const targetPath = `${path.resolve( L65: __dirname, L66: `${process.cwd()}/public/upload`

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

core/file/plugins/system/service.jsView file

Lines 1-22javascript

1const { getConfig, lodash, Sequelize } = require('q-koa')

2const { formatLiteralObj, filterFunction } = require('../../utils')

3const formatPostFunction = (str) => `eval(${str})`

4const nodeVm = require('vm')

Low

Eval

Package source references a known benign dynamic code generation pattern.

core/file/plugins/system/service.jsView on unpkg · L2

5const axios = require('axios')

6const runVm = (_str) => {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

core/file/plugins/system/service.jsView on unpkg · L2

7 return nodeVm.runInNewContext(_str)

10const memRunVm = lodash.memoize(runVm)

11const getLiteral = (str) => {

12 const reg = /literal$(.+)$/

13 const result = str.match(reg)

14 if (result) {

15 return result[1] // 返回第一个捕获组

16 }

17 return ''

18}

19exports.initData = async ({ includes, excludes, app, ctx }) => {

20 const appConfig = getConfig(app)

21 const { version: cacheVersion } = await appConfig.getObject('base')

core/file/plugins/role_permission/controller.jsView file

Lines 1-21javascript

1const { getAppByCtx } = require('q-koa')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/file/plugins/role_permission/controller.jsView on unpkg · L1

3exports.edit = async (ctx

core/restc/faas/install_production.shView file

•path = core/restc/faas/install_production.sh kind = build_helper sizeBytes = 336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/restc/faas/install_production.shView on unpkg

core/file/services/weixinMP.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = q-koa@13.8.5 matchedIdentity = npm:cS1rb2E:13.8.5 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/file/services/weixinMP.jsView on unpkg

core/file/plugins/administrator/controller.jsView file

Lines 1-26javascript

1const { getAppByCtx } = require('q-koa')

2const md5 = require('js-md5')

4const superAdmin

core/config.jsView file

Lines 66-106javascript

66 'common/getLngAndLat',

67 'weixin/mp_login',

68 'log/create',

69 'log/upsert',

70 'auto/minute',

71 'auto/second',

72 ].every

Source & flagged code

9 flagged · loading source

core/file/plugins/common/controller.jsView file

184patternName = generic_password severity = medium line = 184 matchedText = password...hb',

Medium

Secret Pattern

Package contains a possible secret pattern.

core/file/plugins/common/controller.jsView on unpkg · L184

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/file/plugins/common/controller.jsView on unpkg · L15

core/file/plugins/system/service.jsView file

2const { formatLiteralObj, filterFunction } = require('../../utils') L3: const formatPostFunction = (str) => `eval(${str})` L4: const nodeVm = require('vm') L5: const axios = require('axios') L6: const runVm = (_str) => { ... L48: return axios L49: .post(url, { L50: ...data, ... L106: if (!Array.isArray(postInclude(app))) { L107: if (process.env.NODE_ENV !== 'production') { L108: throw new Error(`${url} 返回 include检测是否数组`)

Findings

1 High9 Medium6 Low

HighPrevious Version Dangerous Deltacore/file/services/weixinMP.js

MediumSecret Patterncore/file/plugins/common/controller.js

MediumDynamic Requirecore/file/plugins/role_permission/controller.js

MediumUnsafe Vm Contextcore/file/plugins/system/service.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/restc/faas/install_production.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterncore/file/plugins/administrator/controller.js

MediumSecret Patterncore/config.js

LowScripts Present

LowEvalcore/file/plugins/system/service.js

LowWeak Crypto

Affected versions and remediation

This report applies to q-koa@13.8.6.

See all versions of q-koa for other recorded verdicts.

Review the evidence and your use of q-koa@13.8.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-13 04:18:00.017Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.