q-koa@13.8.72
AI Security Review
scanned 4d ago · by lpm-firewall-aiSource review found no install hook or concrete malicious behavior. The scanner’s dynamic-evaluation signal maps to configured query assembly, and the reported account action is cache clearing.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Application startup registers the cache-clear listener; configured data queries may use an include expression.
Impact
No unauthorized account action, credential transfer, or installation-time mutation was established.
Mechanism
The listener clears a cache entry, while query assembly evaluates its configured include expression.
AI rationale
Source review found no install hook or concrete malicious behavior. The scanner’s dynamic-evaluation signal maps to configured query assembly, and the reported account action is cache clearing.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install lifecycle hook; its scripts are development or operator commands.
- The startup handler subscribes to the cache-clear event and clears the named cache entry.
- Dynamic evaluation processes a configured include expression for data-query assembly; no independent attack behavior was identified in the inspected path.
- The payment, upload, file-generation, and development-version update code is tied to application requests or development configuration.
- The inspected Toutiao and WeChat services request access tokens from their respective service APIs.
Evidence against
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcecore/file/plugins/common/controller.jsView file
•matchType = normalized_sha256
matchedPackage = q-koa@13.8.67
matchedPath = [redacted].js
matchedIdentity = npm:cS1rb2E:13.8.67
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/file/plugins/common/controller.jsView on unpkg184patternName = generic_password
severity = medium
line = 184
Medium
Secret Pattern
Package contains a possible secret pattern.
core/file/plugins/common/controller.jsView on unpkg · L18415const OSS = require('ali-oss')
L16: const axios = require('axios')
L17: const util = require('util')
...
L58:
L59: const imgData = Buffer.from(reader).toString('base64')
L60: // 转换为 data:image/jpeg;base64,***** 格式的字符串
L61: const base64 = `data:${file.name.split('.')[1]};base64,${imgData}`
...
L64: const targetPath = `${path.resolve(
L65: __dirname,
L66: `${process.cwd()}/public/upload`
Low
Weak Crypto
Package source references weak cryptographic algorithms.
Findings
1 Critical9 High8 Medium5 Low
CriticalRemote Response Code Executioncore/file/plugins/system/service.js
HighEvalcore/file/plugins/system/service.js
HighKnown Malware Source Similaritycore/app.js
HighKnown Malware Source Similaritycore/file/plugins/alipay/controller.js
HighKnown Malware Source Similaritycore/file/plugins/common/controller.js
HighKnown Malware Source Similaritycore/file/plugins/model/controller.js
HighKnown Malware Source Similaritycore/file/plugins/setting/afterExecute.js
HighKnown Malware Source Similaritycore/file/plugins/system/controller.js
HighKnown Malware Source Similaritycore/file/services/toutiao.js
HighKnown Malware Source Similaritycore/file/services/weixinMP.js
Affected versions and remediation
This report applies to q-koa@13.8.72.
See all versions of q-koa for other recorded verdicts.
- Review the evidence and your use of q-koa@13.8.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.