registry / @looop-games/cli / 0.1.16

@looop-games/cli@0.1.16

Looop game development CLI — dev server, login, and publishing for standalone Looop games.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 159 KB of source, external domains: play.looop.games, www.partykit.io

Source & flagged code

2 flagged

lib/lint.mjsView file

Lines 11-51javascript

11// command resolves them out of the game's installed engine, which is the very

12// same file its eslint.config.js imports. One copy: the gate and the editor

13// cannot disagree.

14//

15// Escape hatch: `// eslint-disable-next-line looop/<rule>` — the one every

16// developer already knows. This is mandatory, not a nicety: creators are not

17// developers, and a false positive must never wall someone out of their own

18// test command with no way through.

19import { existsSync } from 'node:fs';

20import { createRequire } from 'node:module';

21import { join, relative } from 'node:path';

22import { pathToFileURL } from 'node:url';

23import { findProject, resolveEngine } from './project.mjs';

25const CONFIG_NAMES = ['eslint.config.js', 'eslint.config.mjs', 'eslint.config.cjs'];

27// Resolve ESLint from the GAME's node_modules — same preflight shape as

28// playwright in test-cmd.mjs. Games scaffolded before lint existed simply don't

29// have it; they skip rather than break.

30async function loadFromProject(projectDir) {

31 try {

32 const req = createRequire(join(projectDir, 'package.json'));

33 const mod = await import(pathToFileURL(req.resolve('eslint')).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/lint.mjsView on unpkg · L31

34 return mod.ESLint ?? mod.default?.ESLint ?? null;

35 } catch {

36 return null;

37 }

38}

40// The shareable config, out of the installed engine artifact.

41//

42// The two ways this can come up empty are DIFFERENT problems with different

43// fixes, and conflating them sends people in a circle: the first version of this

44// said "engine ships no rules — run looop update" when the engine was not

45// installed at all, so `looop update` was the one command that could never help.

46// Say which it is.

47async function loadRulesFromEngine(projectDir) {

48 let engineDir;

49 try {

50 ({ dir: engineDir } = resolveEngine(projectDir));

51 } catch {

lib/dev.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @looop-games/cli@0.1.15 matchedIdentity = npm:QGxvb29wLWdhbWVzL2NsaQ:0.1.15 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dev.mjsView on unpkg

Source & flagged code

2 flagged · loading source

lib/lint.mjsView file

31try { L32: const req = createRequire(join(projectDir, 'package.json')); L33: const mod = await import(pathToFileURL(req.resolve('eslint')).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/lint.mjsView on unpkg · L31

lib/dev.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dev.mjsView on unpkg

Findings

1 High3 Medium4 Low

HighPrevious Version Dangerous Deltalib/dev.mjs

MediumDynamic Requirelib/lint.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

lib/lint.mjsView file

Lines 11-51javascript

11// command resolves them out of the game's installed engine, which is the very

12// same file its eslint.config.js imports. One copy: the gate and the editor

13// cannot disagree.

14//

15// Escape hatch: `// eslint-disable-next-line looop/<rule>` — the one every

16// developer already knows. This is mandatory, not a nicety: creators are not

17// developers, and a false positive must never wall someone out of their own

18// test command with no way through.

19import { existsSync } from 'node:fs';

20import { createRequire } from 'node:module';

21import { join, relative } from 'node:path';

22import { pathToFileURL } from 'node:url';

23import { findProject, resolveEngine } from './project.mjs';

25const CONFIG_NAMES = ['eslint.config.js', 'eslint.config.mjs', 'eslint.config.cjs'];

27// Resolve ESLint from the GAME's node_modules — same preflight shape as

28// playwright in test-cmd.mjs. Games scaffolded before lint existed simply don't

29// have it; they skip rather than break.

30async function loadFromProject(projectDir) {

31 try {

32 const req = createRequire(join(projectDir, 'package.json'));

33 const mod = await import(pathToFileURL(req.resolve('eslint')).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/lint.mjsView on unpkg · L31

34 return mod.ESLint ?? mod.default?.ESLint ?? null;

35 } catch {

36 return null;

37 }

38}

40// The shareable config, out of the installed engine artifact.

41//

42// The two ways this can come up empty are DIFFERENT problems with different

43// fixes, and conflating them sends people in a circle: the first version of this

44// said "engine ships no rules — run looop update" when the engine was not

45// installed at all, so `looop update` was the one command that could never help.

46// Say which it is.

47async function loadRulesFromEngine(projectDir) {

48 let engineDir;

49 try {

50 ({ dir: engineDir } = resolveEngine(projectDir));

51 } catch {

lib/dev.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dev.mjsView on unpkg