kordoc@4.24.6
CAUTIONPublisher claims: "Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff, print & layout-preserving SVG renderer" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher chrisryugj · joined 0 days agoInstalls 139KLast detonated 2 h ago
Behavior trace
Honeypot run · 3 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
2.0sprocessdependency install exit 1
2.2sprocessexec /usr/bin/timeout
2.2sprocessexited 1: Node.js v22.23.4
2.2sclaimedno tools/list reply (exit 1)
2.3sprocessscript backend runs setup only
Static findings
CRITICAL
Access to sensitive file pathsdist/chunk-DFRQD254.js:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-DC6CTQTK.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-PKCOOSDT.js:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-RMUDX5Q2.js:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-435ECXNG.cjs:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-XVTGFK2F.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-TZVVK5MI.js:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-6H25SXDI.js:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-2JDVPQ33.cjs:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-435ECXNG.cjs:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-TK3FDAEE.cjs:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/chunk-RMUDX5Q2.js:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Destructive file system command detecteddist/cli.js:412 · Destructive file system command detected
AST05CRITICAL
Destructive file system command detecteddist/cli.js:1699 · Destructive file system command detected
AST05CRITICAL
Access to sensitive file pathsdist/chunk-XVTGFK2F.js:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Destructive file system command detecteddist/cli.js:1593 · Destructive file system command detected
AST05CRITICAL
Destructive file system command detecteddist/cli.js:1658 · Destructive file system command detected
AST05CRITICAL
Destructive file system command detecteddist/mcp.js:258 · Destructive file system command detected
AST05CRITICAL
Destructive file system command detecteddist/cli.js:2034 · Destructive file system command detected
AST05HIGH
npx invocation of non-well-known packageREADME.md:64 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-435ECXNG.cjs:272 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
npx invocation of non-well-known packageREADME.md:63 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-AM5ALISV.cjs:302 · Unicode escape sequence detected — may contain obfuscated payloads
AST07CRITICAL
Access to sensitive file pathsdist/setup-WHTMPK74.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Pipe to network utilitydist/parser-ES3I54QL.js:2465 · Pipe to network utility — potential reverse shell
AST05CRITICAL
Access to sensitive file pathsdist/setup-WHTMPK74.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HIGH
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:25 · Unicode escape sequence detected — may contain obfuscated payloads
AST07CRITICAL
Pipe to network utilitydist/parser-KGDUPSA7.js:2455 · Pipe to network utility — potential reverse shell
AST05CRITICAL
Access to sensitive file pathsdist/setup-WHTMPK74.js:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HIGH
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:20 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
npx invocation of non-well-known packagedist/chunk-2JDVPQ33.cjs:124 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:27 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Hidden zero-width characters detecteddist/chunk-5RZBLPVP.js:76 · Hidden zero-width characters detected — may conceal content
AST07CRITICAL
Destructive file system command detecteddist/mcp.js:1013 · Destructive file system command detected
AST05HIGH
Unicode escape sequence detecteddist/chunk-2JDVPQ33.cjs:24 · Unicode escape sequence detected — may contain obfuscated payloads
AST07CRITICAL
Pipe to network utilitydist/parser-AGDY3ZOA.cjs:2458 · Pipe to network utility — potential reverse shell
AST05HIGH
npx invocation of non-well-known packageREADME.md:39 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
npx invocation of non-well-known packageREADME.md:62 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:16 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
npx invocation of non-well-known packageREADME.md:34 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:14 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-BZW2WS44.js:1583 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-BZW2WS44.js:1247 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-BZW2WS44.js:1464 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-EBJWBGWF.js:1260 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-BZW2WS44.js:1257 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-BKTEGPEO.js:396 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-EBJWBGWF.js:1250 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-EBJWBGWF.js:1476 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-BKTEGPEO.js:1788 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
npx invocation of non-well-known packagedist/chunk-DFRQD254.js:124 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-BZW2WS44.js:1473 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-EBJWBGWF.js:1467 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-DFRQD254.js:24 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-J4XCQNVH.cjs:1583 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-J4XCQNVH.cjs:1247 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/cli.js:403 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-WNOWRBM4.js:302 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-XVTGFK2F.js:272 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-EBJWBGWF.js:1586 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
npx invocation of non-well-known packagedist/chunk-TZVVK5MI.js:134 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
Unicode escape sequence detecteddist/chunk-PKCOOSDT.js:257 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-J4XCQNVH.cjs:1257 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/cli.js:221 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/cli.js:448 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/cli.js:497 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-GYX26HZR.js:5809 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-W75FRCAP.js:5675 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-JIU7E7Z6.cjs:5809 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-TZVVK5MI.js:27 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Hidden zero-width characters detecteddist/cli.js:479 · Hidden zero-width characters detected — may conceal content
AST07HIGH
Unicode escape sequence detecteddist/chunk-J4XCQNVH.cjs:1464 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-J4XCQNVH.cjs:1473 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/chunk-XM2Y4DB5.js:256 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/mcp.js:124 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-AGDY3ZOA.cjs:3842 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/mcp.js:183 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/image-ocr-N3I3MUKF.cjs:47 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/mcp.js:107 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/mcp.js:128 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-AGDY3ZOA.cjs:1396 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/image-ocr-5POXVGN2.js:51 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/mcp.js:120 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-AGDY3ZOA.cjs:852 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/cli.js:656 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/image-ocr-7NCSIZGA.js:46 · Unicode escape sequence detected — may contain obfuscated payloads
AST07MEDIUM
File type combined with upload actiondist/cli.js:1066 · File type combined with upload action — agent may exfiltrate local data files
AST07HIGH
Unicode escape sequence detecteddist/redact-doc-OYXBNTWI.js:921 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/watch-P6UWW52D.js:41 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/redact-doc-OYXBNTWI.js:1165 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/redact-doc-OYXBNTWI.js:923 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-KGDUPSA7.js:1393 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/redact-doc-OYXBNTWI.js:1154 · Unicode escape sequence detected — may contain obfuscated payloads
AST07MEDIUM
File type combined with upload actiondist/index.d.ts:2804 · File type combined with upload action — agent may exfiltrate local data files
AST07HIGH
Unicode escape sequence detecteddist/parser-ES3I54QL.js:4261 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/setup-WHTMPK74.js:145 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-KGDUPSA7.js:4251 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-ES3I54QL.js:1403 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-ES3I54QL.js:859 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/setup-WHTMPK74.js:173 · Unicode escape sequence detected — may contain obfuscated payloads
AST07MEDIUM
File type combined with upload actiondist/cli.js:1294 · File type combined with upload action — agent may exfiltrate local data files
AST07HIGH
Unicode escape sequence detecteddist/parser-ES3I54QL.js:3849 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-KGDUPSA7.js:3839 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-AGDY3ZOA.cjs:4254 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
Unicode escape sequence detecteddist/parser-KGDUPSA7.js:849 · Unicode escape sequence detected — may contain obfuscated payloads
AST07