registry / @minecraft/creator-tools / 0.17.6

@minecraft/creator-tools@0.17.6

⚠ Under review

Minecraft Creator Tools command line and libraries.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,139 file(s), 16.9 MB of source, external domains: 127.0.0.1, aka.ms, bugzilla.mozilla.org, code.google.com, code.visualstudio.com, developer.mozilla.org, developers.google.com, drafts.csswg.org, en.wikipedia.org, git.io, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, json-schema.org, learn.microsoft.com, mctools.dev, net-secondary.web.minecraft-services.net, r12a.github.io, raw.githubusercontent.com, registry.npmjs.org, res-1.cdn.office.net, res.cdn.office.net, sass-lang.com, schema.org, stackoverflow.com, support.google.com, tools.ietf.org, wiki.whatwg.org, www.apache.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.minecraft.net, www.npmjs.com, www.w3.org, www.whatwg.org

Oversized source lightweight scan

cli/TaskWorker.mjs5.61 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsEvalCryptoHighEntropyStrings

cli/index.mjs9.36 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsShellHighEntropyStringsUrlStringsgithub.comjson-schema.orglearn.microsoft.commctools.devwww.minecraft.net

dist/vs/editor/editor.main.js3.46 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringswww.w3.org

dist/vs/language/typescript/tsWorker.js4.39 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringswww.apache.org

electron/main.mjs7.26 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsgit.io

web/web.js20.2 MB file, sampled 256 KB

ChildProcessMinified

Source & flagged code

11 flagged

lib/gameTest/Test.jsView file

Lines 551-591javascript

551 */

552 setTntFuse(entity, fuseLength) { }

553 /**

554 * @remarks

555 * Spawns an entity at a location.

556 * @param entityTypeIdentifier

557 * Type of entity to create. If no namespace is provided,

558 * 'minecraft:' is assumed. Note that an optional initial spawn

559 * event can be specified between less than/greater than signs

560 * (e.g., namespace:entityType<spawnEvent>).

561 * @param blockLocation

562 * @returns

563 * The spawned entity. If the entity cannot be spawned, returns

564 * undefined.

565 * @throws This function can throw errors.

566 * @example spawnAdultPig.js

567 * ```typescript

568 * test.spawn("minecraft:pig<minecraft:ageable_grow_up>", new BlockLocation(1, 2, 1));

569 *

570 * ```

571 */

572 spawn(entityTypeIdentifier, blockLocation) {

573 return new Entity_1.default();

High

Child Process

Package source references child process execution.

lib/gameTest/Test.jsView on unpkg · L571

574 }

575 /**

576 * @remarks

577 * Spawns an entity at a location.

578 * @param entityTypeIdentifier

579 * Type of entity to create. If no namespace is provided,

580 * 'minecraft:' is assumed. Note that an optional initial spawn

581 * event can be specified between less than/greater than signs

582 * (e.g., namespace:entityType<spawnEvent>).

583 * @param location

584 * @returns

585 * The spawned entity. If the entity cannot be spawned, returns

586 * undefined.

587 * @throws This function can throw errors.

588 * @example spawnAdultPig.js

589 * ```typescript

590 * test.spawn("minecraft:pig<minecraft:ageable_grow_up>", new Location(1.5, 2, 1.5));

591 * ```

dist/vs/base/worker/workerMain.jsView file

Lines 1-28javascript

1/*!-----------------------------------------------------------

3 * Version: 0.48.0(0037b13fb5d186fdf1e7df51a9416a2de2b8c670)

4 * Released under the MIT license

5 * https://github.com/microsoft/vscode/blob/main/LICENSE.txt

6 *-----------------------------------------------------------*/(function(){var X=["require","exports","vs/editor/common/core/range","vs/editor/common/core/offsetRange","vs/editor/common/core/position"

lib/local/NodeFolder.jsView file

Lines 280-320javascript

280 fileInclusionList.push(targetFileSize);

281 }

282 }

283 if (encoding === StorageUtilities_1.EncodingType.ByteBuffer) {

284 let arrData = file.content;

285 if (targetFileSize &&

286 arrData instanceof Buffer

electron/main.mjsView file

•context = n [binPath, []];\n }\n }\n };\n var isTTY = () => tty.isatty(2);\n var fsSync = {\n readFile(tempFile, callback) {\n try {\n let contents = fs22.readFileSync(tempFile, "utf8");\n try {\n fs22.unlinkSync(tempFile);\n } catch {\n }\n callback(null, contents);\n } catch (err2) {\n callback(err2, null);\n }\n },\n writeFile(contents, callback) {\n try {\n let tempFile = randomFileName();\n fs22.writeFileSync(tempFile, contents);\n callback(tempFile);\n } catch {\n callback(null);\n }\n }\n };\n var fsAsync = {\n readFile(tempFile, callback) {\n try {\n fs22.readFile(tempFile, "utf8", (err2, contents) => {\n try {\n fs22.unlink(tempFile, () => callback(err2, contents));\n } catch {\n callback(err2, contents);\n }\n });\n } catch (err2) {\n callback(err2, null);\n }\n }

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

electron/main.mjsView on unpkg

mc/creator_tools_ingame.mcaddonView file

•path = mc/creator_tools_ingame.mcaddon kind = compressed_blob sizeBytes = 59243 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

mc/creator_tools_ingame.mcaddonView on unpkg

•path = mc/creator_tools_ingame.mcaddon kind = nested_archive_needs_inspection sizeBytes = 59243 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

mc/creator_tools_ingame.mcaddonView on unpkg

web/c417ee867416d52e5187.woff2View file

•path = web/c417ee867416d52e5187.woff2 kind = high_entropy_blob sizeBytes = 13336 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/c417ee867416d52e5187.woff2View on unpkg

dist/vs/language/typescript/tsWorker.jsView file

•path = [redacted].js kind = oversized_source_file sizeBytes = 4600446 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/vs/language/typescript/tsWorker.jsView on unpkg

cli/TaskWorker.mjsView file

•path = cli/TaskWorker.mjs kind = oversized_cli_entrypoint sizeBytes = 5882363 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli/TaskWorker.mjsView on unpkg

Source & flagged code

11 flagged · loading source

lib/gameTest/Test.jsView file

571*/ L572: spawn(entityTypeIdentifier, blockLocation) { L573: return new Entity_1.default();

High

Child Process

Package source references child process execution.

lib/gameTest/Test.jsView on unpkg · L571

dist/vs/base/worker/workerMain.jsView file

18`).slice(2).join(` L19: `).trim();_.register(z,U,z)}return z}),this._event}_removeListener(S){var M,D,T,k;if((D=(M=this._options)===null||M===void 0?void 0:M.onWillRemoveListener)===null||D===void 0||D.ca... L20: `)}isStronglyEqual(d,g){return this.lines[d]===this.lines[g]}}n.LineSequence=r;function x(A){let d=0;for(;d<A.length&&(A.charCodeAt(d)===32||A.charCodeAt(d)===9);)d++;return d}}),Y...

High

Shell

Package source references shell execution.

dist/vs/base/worker/workerMain.jsView on unpkg · L18

10})`}});function A(){try{return(x?globalThis.eval(x.createScript("","true")):new Function("true")).call(globalThis),!0}catch{return!1}}function d(){return new Promise((v,e)=>{if(typ... L11: //# sourceURL=${s}`,(x?globalThis.eval(x.createScript("",h)):new Function(h)).call(globalThis),v()}).then(void 0,e);return}x?importScripts(x.createScriptURL(s)):importScripts(s),v(... L12: ... L25: `?new e(L):null;R.reset(N.column-1);const C=R.next(L);return C?v(this._getMultilineMatchRange(_,l,L,b,C.index,C[0]),C,w):N.lineNumber!==1||N.column!==1?this._doFindNextMatchMultili... L26: `||e===" "}}),Y(X[61],Z([0,1]),function(O,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.WrappingIndent=n.TrackedRangeStickiness=n.TextEditorCursorStyle=n.TextE... L27:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/vs/base/worker/workerMain.jsView on unpkg · L10

5* https://github.[redacted].txt L6: *-----------------------------------------------------------*/(function(){var X=["require","exports","vs/editor/common/core/range","[redacted]","vs/editor/co... L7: //# sourceURL=${v}`,(u?self.eval(u.createScript("",m)):new Function(m)).call(self),e()}).then(void 0,s);return}try{u&&(v=u.createScriptURL(v)),importScripts(v),e()}catch(m){s(m)}}}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vs/base/worker/workerMain.jsView on unpkg · L5

lib/local/NodeFolder.jsView file

300hash.update(arrData); L301: targetFileSize.hash = hash.digest("base64"); L302: const pathHash = this.generatePathHash(targetFileSize);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/local/NodeFolder.jsView on unpkg · L300

electron/main.mjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

electron/main.mjsView on unpkg

mc/creator_tools_ingame.mcaddonView file

•path = mc/creator_tools_ingame.mcaddon kind = compressed_blob sizeBytes = 59243 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

mc/creator_tools_ingame.mcaddonView on unpkg

•path = mc/creator_tools_ingame.mcaddon kind = nested_archive_needs_inspection sizeBytes = 59243 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

mc/creator_tools_ingame.mcaddonView on unpkg

web/c417ee867416d52e5187.woff2View file

•path = web/c417ee867416d52e5187.woff2 kind = high_entropy_blob sizeBytes = 13336 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/c417ee867416d52e5187.woff2View on unpkg

dist/vs/language/typescript/tsWorker.jsView file

•path = [redacted].js kind = oversized_source_file sizeBytes = 4600446 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/vs/language/typescript/tsWorker.jsView on unpkg

cli/TaskWorker.mjsView file

•path = cli/TaskWorker.mjs kind = oversized_cli_entrypoint sizeBytes = 5882363 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli/TaskWorker.mjsView on unpkg

Findings

1 Critical5 High5 Medium8 Low

CriticalEncrypted Payload Temp Executionelectron/main.mjs

HighChild Processlib/gameTest/Test.js

HighShelldist/vs/base/worker/workerMain.js

HighSame File Env Network Executiondist/vs/base/worker/workerMain.js

HighShips High Entropy Blobweb/c417ee867416d52e5187.woff2

HighOversized Source Filedist/vs/language/typescript/tsWorker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobmc/creator_tools_ingame.mcaddon

MediumOversized Cli Entrypointcli/TaskWorker.mjs

MediumStructural Risk Force Deep Review

LowEvaldist/vs/base/worker/workerMain.js

LowWeak Cryptolib/local/NodeFolder.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNested Archive Needs Inspectionmc/creator_tools_ingame.mcaddon

Source & flagged code

11 flagged

lib/gameTest/Test.jsView file

Lines 551-591javascript

551 */

552 setTntFuse(entity, fuseLength) { }

553 /**

554 * @remarks

555 * Spawns an entity at a location.

556 * @param entityTypeIdentifier

557 * Type of entity to create. If no namespace is provided,

558 * 'minecraft:' is assumed. Note that an optional initial spawn

559 * event can be specified between less than/greater than signs

560 * (e.g., namespace:entityType<spawnEvent>).

561 * @param blockLocation

562 * @returns

563 * The spawned entity. If the entity cannot be spawned, returns

564 * undefined.

565 * @throws This function can throw errors.

566 * @example spawnAdultPig.js

567 * ```typescript

568 * test.spawn("minecraft:pig<minecraft:ageable_grow_up>", new BlockLocation(1, 2, 1));

569 *

570 * ```

571 */

572 spawn(entityTypeIdentifier, blockLocation) {

573 return new Entity_1.default();

High

Child Process

Package source references child process execution.

lib/gameTest/Test.jsView on unpkg · L571

574 }

575 /**

576 * @remarks

577 * Spawns an entity at a location.

578 * @param entityTypeIdentifier

579 * Type of entity to create. If no namespace is provided,

580 * 'minecraft:' is assumed. Note that an optional initial spawn

581 * event can be specified between less than/greater than signs

582 * (e.g., namespace:entityType<spawnEvent>).

583 * @param location

584 * @returns

585 * The spawned entity. If the entity cannot be spawned, returns

586 * undefined.

587 * @throws This function can throw errors.

588 * @example spawnAdultPig.js

589 * ```typescript

590 * test.spawn("minecraft:pig<minecraft:ageable_grow_up>", new Location(1.5, 2, 1.5));

591 * ```

dist/vs/base/worker/workerMain.jsView file

Lines 1-28javascript

1/*!-----------------------------------------------------------

3 * Version: 0.48.0(0037b13fb5d186fdf1e7df51a9416a2de2b8c670)

4 * Released under the MIT license

5 * https://github.com/microsoft/vscode/blob/main/LICENSE.txt

lib/local/NodeFolder.jsView file

Lines 280-320javascript

280 fileInclusionList.push(targetFileSize);

281 }

282 }

283 if (encoding === StorageUtilities_1.EncodingType.ByteBuffer) {

284 let arrData = file.content;

285 if (targetFileSize &&

286 arrData instanceof Buffer

electron/main.mjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

electron/main.mjsView on unpkg

mc/creator_tools_ingame.mcaddonView file

•path = mc/creator_tools_ingame.mcaddon kind = compressed_blob sizeBytes = 59243 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

mc/creator_tools_ingame.mcaddonView on unpkg

•path = mc/creator_tools_ingame.mcaddon kind = nested_archive_needs_inspection sizeBytes = 59243 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

mc/creator_tools_ingame.mcaddonView on unpkg

web/c417ee867416d52e5187.woff2View file

•path = web/c417ee867416d52e5187.woff2 kind = high_entropy_blob sizeBytes = 13336 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/c417ee867416d52e5187.woff2View on unpkg

dist/vs/language/typescript/tsWorker.jsView file

•path = [redacted].js kind = oversized_source_file sizeBytes = 4600446 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/vs/language/typescript/tsWorker.jsView on unpkg

cli/TaskWorker.mjsView file

•path = cli/TaskWorker.mjs kind = oversized_cli_entrypoint sizeBytes = 5882363 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli/TaskWorker.mjsView on unpkg