registry / qaq-core-util-v2 / 1.1.71

qaq-core-util-v2@1.1.71

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed install-time malware was found, but exported cache helpers can send caller data to a hardcoded external Redis service. The package also includes external business API calls and a shipped cache endpoint/secret-like configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime invocation of exported cache, price, S3, or mail utility functions.

Impact

Potential unintended disclosure or modification of application cache data if Redis helpers are used.

Mechanism

hardcoded external cache/API integrations with caller-supplied data

Attack narrative

If a downstream application calls setCacheRedis/getCacheRedis expecting its own cache endpoint, the package instead connects to the embedded Redis Cloud host with embedded credentials and reads/writes caller-supplied cache keys and values there. This is runtime and user-invoked, not automatic on install or import.

Rationale

Static inspection did not show lifecycle execution or automatic credential/file harvesting, so a publish block is not justified. The embedded external Redis credential and ignored cachedUrl create real unresolved data-disclosure risk, so warn rather than mark clean.

Evidence

package.jsonindex.js.envlib/memcached.jslib/issueReturn.manger.jslib/s3.manger.jslib/mail.manger.jslib/excel.manger.js

Network endpoints4

redis-18814.c245.us-east-1-3.ec2.redns.redis-cloud.com:18814lb-memcache-8eb1a1560000a8a6.elb.ap-southeast-1.amazonaws.com:80apilb.kapugems.com/cachePrice/load/<bucket>/<key>

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

lib/memcached.js hardcodes Redis Cloud host and password, ignoring cachedUrl in Redis cache functions.
lib/memcached.js setCacheRedis writes caller-supplied values to that hardcoded Redis endpoint.
.env ships a CACHED_URL value for an external memcache ELB.
lib/issueReturn.manger.js posts user/runtime data to https://apilb.kapugems.com/cachePrice/load.
lib/issueReturn.manger.js uses eval(formula), but formula appears DB/config driven for price/display calculation.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
index.js only exports wrapper functions; no obvious install-time or import-time exfiltration.
Network use is mostly cache/S3/mail/business API functionality exposed through user-called utilities.
No child_process, shell execution, persistence, destructive filesystem actions, or AI-agent control-surface writes found.
S3 and SMTP credentials are taken from caller/runtime config, not harvested from the host.

Behavioral surface

Source

CryptoEnvironmentVars

Source & flagged code

5 flagged

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: CACHED_URL=<redacted:64 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

lib/issueReturn.manger.jsView file

Lines 1570-1610javascript

1570 disMap["status"] = data["stt"];

1571

1572 for (let f = 0; f < formulaAttrLength; f++) {

1573 let attr = formulaAttr[f];

1574 let formula = dataTypeFormatDtl[attr + "#FL"] || '';

1575 if (formula != '') {

1576 let dependAttr = dataTypeFormatDtl[attr + "#FL#ATTR"] || [];

1577 let dependAttrLength = dependAttr.length;

1578 if (dependAttrLength > 0) {

1579 let attrVal = 'N';

1580 for (let l = 0; l < dependAttrLength; l++) {

1581 let depAttr = dependAttr[l];

1582 if (resultView.indexOf(depAttr) > -1) {

1583 formula = replaceall("#" + depAttr, disMap[depAttr] || "0", formula);

1584 attrVal = 'Y';

1585 } else {

1586 attrVal = 'N'

1587 break;

1588 }

1589 }

1590 if (attrVal != 'N') {

1591 attrVal = eval(formula);

1592 let format = dataTypeFormatDtl[attr + "#F"] || 'N';

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/issueReturn.manger.jsView on unpkg · L1590

1593 if (format != 'N') {

1594 attrVal = coreUtil.floorFigure(attrVal, format);

1595 }

1596 disMap[attr] = attrVal;

1597 } else

1598 disMap[attr] = '';

1599 } else {

1600 disMap[attr] = '';

1601 }

1602 } else {

1603 disMap[attr] = '';

1604 }

1605 }

1606 disMap["qty"] = data["qtys"];

1607 issueMap["qty"] = data["qtys"];

1608 returnMap["qty"] = data["qtys"];

1609 for (let k = 0; k < ktsAttrListLen; k++) {

1610 let attr = ktsAttrList[k];

lib/memcached.jsView file

Lines 81-171javascript

81 }

82 });

83 }

84};

86exports.getCacheRedis = function(key,cachedUrl) {

87 return new

Source & flagged code

5 flagged · loading source

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: CACHED_URL=<redacted:64 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

lib/issueReturn.manger.jsView file

1590if (attrVal != 'N') { L1591: attrVal = eval(formula); L1592: let format = dataTypeFormatDtl[attr + "#F"] || 'N';

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/issueReturn.manger.jsView on unpkg · L1590

lib/memcached.jsView file

101patternName = generic_password severity = medium line = 101 matchedText = password...WF",

Medium

Findings

1 Critical5 Medium5 Low

CriticalCritical Secret.env

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternlib/memcached.js

LowScripts Present

LowEvallib/issueReturn.manger.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings