registry / @4399aigame/aigame / 2.1.0
@4399aigame/aigame@2.1.0
4399 AI 小游戏开发工具链 - MCP Server + CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/maker.jsView file
5L6: var node_child_process = require('node:child_process');
L7: var crypto = require('node:crypto');
High
5Cross-file remote execution chain: dist/maker.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L5:
L6: var node_child_process = require('node:child_process');
L7: var crypto = require('node:crypto');
...
L19: var node_url = require('node:url');
L20: var http = require('node:http');
L21: var zlib = require('node:zlib');
...
L81:
L82: const ESC = String.fromCharCode(27);
L83: const ANSI_PATTERN = new RegExp(`${ESC}\\[[0-9;]*m`, "g");
...
L233: function resolveEnvironmentFromEnv() {
L234: const value = process.env.AIGAME_ENV ?? process.env.TDS_MCP_ENV;
L235: return value === "rnd" ? "rnd" : "production";
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/maker.jsView on unpkg · L5dist/proxy.jsView file
Findings
2 High4 Medium5 Low
HighChild Processdist/maker.js
HighCross File Remote Execution Contextdist/maker.js
MediumDynamic Requiredist/proxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @4399aigame/aigame@2.1.0.
See all versions of @4399aigame/aigame for other recorded verdicts.
- Review the evidence and your use of @4399aigame/aigame@2.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.