registry  /  @energy8platform/platform-core  /  0.30.3

@energy8platform/platform-core@0.30.3

Energy8 platform core: Lua engine, DevBridge, RTP simulation, and SDK session orchestration. Renderer-agnostic — pair with any game framework (Pixi, Phaser, Three.js, custom).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 48 file(s), 379 KB of source, external domains: cdn.jsdelivr.net, fonts.googleapis.com, github.com, www.w3.org

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install-e8.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/simulate.tsView file
68try { L69: const mod = await import(configPath); L70: config = mod.default ?? mod.config ?? mod;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/simulate.tsView on unpkg · L68
scripts/install-e8.mjsView file
9Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network L9: * Delivery: GitHub Releases of THIS repo (game-engine), tag `e8-v<version>` L10: * — the engine source lives in the private casino-platform repo, so the L11: * binaries are published here, same discipline as the old Go simulate CLI. ... L16: import { fileURLToPath } from 'url'; L17: import { get } from 'https'; L18: L19: const __dirname = dirname(fileURLToPath(import.meta.url)); L20: const BIN_DIR = join(__dirname, '..', 'bin'); ... L23: L24: const REPO = process.env.E8_RELEASE_REPO || 'energy8platform/game-engine'; L25: // e8 binary version — bump when new Rust binaries are uploaded to Releases. ... L42: async function main() {
High
Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/install-e8.mjsView on unpkg · L9

Findings

2 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/install-e8.mjs
MediumDynamic Requirebin/simulate.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings