@4399aigame/aigame@2.1.2
4399 AI 小游戏开发工具链 - MCP Server + CLI
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe bundled CLI sends runtime usage tracking without a disclosure or opt-out found in the reviewed README. The payload is limited to account/project identifiers and activity metadata, so this is warning-level telemetry rather than credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An MCP client requests resources or lists tools while using the package.
Impact
Links MCP usage to a Maker account and project. The reviewed payload does not show credential or content collection.
Mechanism
The package sends JSON containing account/project identifiers and activity metadata to /tracking on the configured Maker API origin.
AI rationale
The bundled CLI sends runtime usage tracking without a disclosure or opt-out found in the reviewed README. The payload is limited to account/project identifiers and activity metadata, so this is warning-level telemetry rather than credential exfiltration.
Evidence
dist/cli.js
Network endpoints1
<configured Maker API origin>/tracking
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- MCP resource requests automatically invoke the activity-reporting helper.
- The tracking payload can include Maker user and project IDs, tool and request IDs, duration, success, and error details.
- The package POSTs this payload to /tracking on its configured Maker API origin.
- The only lifecycle script shown is prepublishOnly, which runs a production build.
Evidence against
- The reported user and project IDs are Maker account or project identifiers; the payload does not show credentials or file, prompt, or tool-output contents.
- The endpoint uses the configured Maker API base rather than a hard-coded unrelated collector.
- Error details are passed through a sanitizer that redacts token-like values.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
8 flaggeddist/cli.jsView file
1#!/usr/bin/env node
L2: var WA=Object.defineProperty;var i=(e,t)=>WA(e,"name",{value:t,configurable:!0});var to,ro,no,oo,uo,io,ao,so,co,lo,po,mo,fo,ho,go,Fo,Eo,yo,vo,wo,Ao,Co,bo,Do;const Hh=require("node:...
L3: `)}i(o5,"box"),sn(o5,"box");function fC(e,t,r={}){const n=" ".repeat(r.gap??3),o=r.offset??0,u=Math.max(0,...e.map(c=>fe(c))),a=Math.max(e.length,t.length+o),s=[];for(let c=0;c<a;c...
...
L7: `)}i(G,"statusBlock"),Yu(G,"statusBlock");function Ie(e){return`${b.info(Fe.arrow)} ${e}`}i(Ie,"nextStep"),Yu(Ie,"nextStep");const ec=6e4,tc=60*ec,c5=24*tc;function l5(e,t=Date.now...
L8: `),hints:n==="login_required"?[`\u624B\u52A8\u767B\u5F55\u4E00\u6B21\uFF1A${b.cmd("aigame login")}`]:["\u8FD9\u662F\u7F51\u7EDC\u6216\u670D\u52A1\u7AEF\u6545\u969C\uFF0C\u7A0D\u540...
L9: `)}i(mc,"formatD
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: var WA=Object.defineProperty;var i=(e,t)=>WA(e,"name",{value:t,configurable:!0});var to,ro,no,oo,uo,io,ao,so,co,lo,po,mo,fo,ho,go,Fo,Eo,yo,vo,wo,Ao,Co,bo,Do;const Hh=require("node:...
L3: `)}i(o5,"box"),sn(o5,"box");function fC(e,t,r={}){const n=" ".repeat(r.gap??3),o=r.offset??0,u=Math.max(0,...e.map(c=>fe(c))),a=Math.max(e.length,t.length+o),s=[];for(let c=0;c<a;c...
High
Findings
1 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/proxy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @4399aigame/aigame@2.1.2.
See all versions of @4399aigame/aigame for other recorded verdicts.
- Review the evidence and your use of @4399aigame/aigame@2.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.