q-koa@13.8.67
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe request-controlled code execution path is a concrete remote code execution surface, although the inspected evidence does not establish whether access controls limit callers. The package’s lack of an install hook and the benign WeChat client setup do not mitigate this runtime risk.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A request reaches the initData handler with includes containing an include field.
Impact
If the endpoint is reachable by an untrusted caller, the supplied code can execute with the server process's privileges.
Mechanism
The service wraps include text in eval syntax, compiles it with new Function, and calls the resulting function.
Attack narrative
A caller can submit include data to initData; the controller forwards it to the service, where include text is compiled and invoked as JavaScript. Reachability and authorization controls for this handler were not established in the inspected excerpts.
AI rationale
The request-controlled code execution path is a concrete remote code execution surface, although the inspected evidence does not establish whether access controls limit callers. The package’s lack of an install hook and the benign WeChat client setup do not mitigate this runtime risk.
Evidence
core/file/plugins/system/controller.jscore/file/plugins/system/service.js
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The initData endpoint reads includes from the request body and forwards it to the service.
- The service constructs and executes code from each include value with new Function.
- The package manifest has no install lifecycle hook; the flagged WeChat service uses a dedicated Axios client.
Evidence against
- The remote-response-code-execution hint is not supported by the inspected code: the service returns response data without evaluating it.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcecore/file/plugins/common/controller.jsView file
184patternName = generic_password
severity = medium
line = 184
Medium
Secret Pattern
Package contains a possible secret pattern.
core/file/plugins/common/controller.jsView on unpkg · L18415const OSS = require('ali-oss')
L16: const axios = require('axios')
L17: const util = require('util')
...
L58:
L59: const imgData = Buffer.from(reader).toString('base64')
L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串
L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}`
...
L64: const targetPath = `${path.resolve(
L65: __dirname,
L66: `${process.cwd()}/public/upload`
Low
Weak Crypto
Package source references weak cryptographic algorithms.
core/file/plugins/common/controller.jsView on unpkg · L15core/file/plugins/system/service.jsView file
3const { formatLiteralObj, filterFunction } = require('../../utils')
L4: const formatPostFunction = (str) => `eval(${str})`
L5: const axios = require('axios')
L6: const runVm = (_str) => {
...
L46: return axios
L47: .post(url, {
L48: ...data,
...
L104: if (!Array.isArray(postInclude(app))) {
L105: if (process.env.NODE_ENV !== 'production') {
L106: throw new Error(`${url} 返回 include检测是否数组`)
Findings
1 Critical2 High8 Medium5 Low
CriticalRemote Response Code Executioncore/file/plugins/system/service.js
HighEvalcore/file/plugins/system/service.js
HighPrevious Version Dangerous Deltacore/file/services/weixinMP.js
MediumSecret Patterncore/file/plugins/common/controller.js
MediumDynamic Requirecore/file/plugins/role_permission/controller.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercore/restc/faas/install_production.sh
MediumStructural Risk Force Deep Review
MediumSecret Patterncore/file/plugins/administrator/controller.js
MediumSecret Patterncore/config.js
LowScripts Present
Affected versions and remediation
This report applies to q-koa@13.8.67.
See all versions of q-koa for other recorded verdicts.
- Avoid installing q-koa@13.8.67. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.