registry  /  @energy8platform/platform-core  /  0.30.1

@energy8platform/platform-core@0.30.1

Energy8 platform core: Lua engine, DevBridge, RTP simulation, and SDK session orchestration. Renderer-agnostic — pair with any game framework (Pixi, Phaser, Three.js, custom).

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 48 file(s), 379 KB of source, external domains: cdn.jsdelivr.net, fonts.googleapis.com, github.com, www.w3.org

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install-e8.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/simulate.tsView file
68try { L69: const mod = await import(configPath); L70: config = mod.default ?? mod.config ?? mod;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/simulate.tsView on unpkg · L68
scripts/install-e8.mjsView file
9Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network L9: * Delivery: GitHub Releases of THIS repo (game-engine), tag `e8-v<version>` L10: * — the engine source lives in the private casino-platform repo, so the L11: * binaries are published here, same discipline as the old Go simulate CLI. ... L16: import { fileURLToPath } from 'url'; L17: import { get } from 'https'; L18: L19: const __dirname = dirname(fileURLToPath(import.meta.url)); L20: const BIN_DIR = join(__dirname, '..', 'bin'); ... L23: L24: const REPO = process.env.E8_RELEASE_REPO || 'energy8platform/game-engine'; L25: // e8 binary version — bump when new Rust binaries are uploaded to Releases. ... L42: async function main() {
High
Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/install-e8.mjsView on unpkg · L9
dist/simulation.cjs.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @energy8platform/platform-core@0.28.3 matchedIdentity = npm:[redacted]:0.28.3 similarity = 0.630 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/simulation.cjs.jsView on unpkg

Findings

3 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/install-e8.mjs
HighPrevious Version Dangerous Deltadist/simulation.cjs.js
MediumDynamic Requirebin/simulate.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings