registry / @playdrop/playdrop-cli / 0.11.6

@playdrop/playdrop-cli@0.11.6

Official Playdrop CLI for publishing browser games, creator apps, and AI-generated game assets on playdrop.ai

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 83 file(s), 1.41 MB of source, external domains: 127.0.0.1, ai.blue.playdrop.ai, ai.green.playdrop.ai, ai.localhost, ai.playdrop.ai, ai.preview.playdrop.ai, api.blue.playdrop.ai, api.green.playdrop.ai, api.openai.com, api.playdrop.ai, api.preview.playdrop.ai, assets-local.playdrop.ai, assets.playdrop.ai, blue.playdrop.ai, github.com, green.playdrop.ai, playdrop.ai, preview.playdrop.ai, raw.githubusercontent.com, slack.com, www.localhost, www.playdrop.ai, www.w3.org

Source & flagged code

5 flagged

dist/playwright.jsView file

Lines 42-82javascript

42const TOOL_NAME = 'playdrop';

43const COMMON_CHROMIUM_ARGS = [

44 '--no-sandbox',

45 '--disable-web-security',

46];

47// Force software WebGL for headless capture so local preview output stays stable.

48exports.HEADLESS_CHROMIUM_ARGS = [

49 ...COMMON_CHROMIUM_ARGS,

50 '--use-gl=angle',

51 '--use-angle=swiftshader',

52 '--enable-unsafe-swiftshader',

53 '--ignore-gpu-blocklist',

54];

55// Visible dev-browser sessions should use the normal GPU path instead of SwiftShader.

56exports.INTERACTIVE_CHROMIUM_ARGS = [

57 ...COMMON_CHROMIUM_ARGS,

58 '--ignore-gpu-blocklist',

59];

60// Backward-compatible alias for older imports.

61exports.CHROMIUM_ARGS = exports.HEADLESS_CHROMIUM_ARGS;

62let customLoader = null;

63const nativeImport = new Function('specifier', 'return import(specifier);');

64function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L62

65 customLoader = loader;

66}

67async function loadPlaywright() {

68 if (customLoader) {

69 return customLoader();

70 }

71 const loaderPath = process.env.PLAYDROP_PLAYWRIGHT_LOADER_PATH?.trim();

72 if (loaderPath) {

73 const loaderModule = await nativeImport((0, node_url_1.pathToFileURL)(loaderPath).href);

74 const candidate = loaderModule.loadPlaywright

75 ?? loaderModule.createPlaywrightModule

76 ?? loaderModule.default

77 ?? loaderModule;

78 if (typeof candidate === 'function') {

79 return await candidate();

80 }

81 if (candidate && typeof candidate === 'object' && typeof candidate.chromium?.launch === 'function') {

82 return candidate;

dist/apiClient.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createCliClientHeaders = createCliClientHeaders;

4exports.createCliApiClient = createCliApiClient;

5exports.createCliAiClient = createCliAiClient;

6const api_client_1 =

dist/commands/worker.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/commands/clients.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

Source & flagged code

5 flagged · loading source

dist/playwright.jsView file

62let customLoader = null; L63: const nativeImport = new Function('specifier', 'return import(specifier);'); L64: function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L62

dist/apiClient.jsView file

5exports.createCliAiClient = createCliAiClient; L6: const api_client_1 = require("@playdrop/api-client"); L7: const ai_client_1 = require("@playdrop/ai-client");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/apiClient.jsView on unpkg · L5

dist/commands/worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @playdrop/playdrop-cli@0.10.20 matchedIdentity = npm:QHBsYXlkcm9wL3BsYXlkcm9wLWNsaQ:0.10.20 similarity = 0.807 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/worker.jsView on unpkg

5Object.defineProperty(exports, "__esModule", { value: true }); L6: exports.WORKER_CONTEXT_COMMAND_NOT_ALLOWED_MESSAGE = exports.WORKER_SESSION_EXPIRED_MESSAGE = exports.runLoggedProcess = exports.[redacted] = exports.readC... L7: exports.allocateWorkerDevPort = allocateWorkerDevPort; ... L102: const WORKER_TRANSCRIPT_CHUNK_BATCH_SIZE = 100; L103: const SLACK_API_BASE_URL = 'https://slack.com/api'; L104: const WORKER_WRAPPER_CONTRACT_VERSION = 1; ... L362: } L363: function resolveWorkerHomeDir() { L364: const custom = node_process_1.default.env.PLAYDROP_WORKER_HOME?.trim(); ... L492: const file = findWorkspaceTaskFile(startDir, 'task.json'); L493: const parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8')); L494: const taskId = Number(parsed.taskId);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/worker.jsView on unpkg · L5

dist/commands/clients.jsView file

14const node_path_1 = require("node:path"); L15: const node_child_process_1 = require("node:child_process"); L16: const output_1 = require("../output"); ... L18: const MAC_APP_PATH = '/Applications/PlayDrop.app'; L19: const MAC_CLIENT_LATEST_URL = 'https://www.playdrop.ai/api/mac-client/latest'; L20: const WINDOWS_CLIENT_EXECUTABLE = 'PlayDrop.exe'; ... L33: async function getClientStatus(options = {}) { L34: const platform = options.platform ?? process.platform; L35: if (platform === 'win32') { ... L78: console.error(WINDOWS_CLIENT_INSTALL_HINT); L79: process.exitCode = 1; L80: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/clients.jsView on unpkg · L14

Findings

3 High5 Medium6 Low

HighEvaldist/playwright.js

HighSandbox Evasion Gated Capabilitydist/commands/clients.js

HighPrevious Version Dangerous Deltadist/commands/worker.js

MediumDynamic Requiredist/apiClient.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/worker.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/playwright.jsView file

Lines 42-82javascript

42const TOOL_NAME = 'playdrop';

43const COMMON_CHROMIUM_ARGS = [

44 '--no-sandbox',

45 '--disable-web-security',

46];

47// Force software WebGL for headless capture so local preview output stays stable.

48exports.HEADLESS_CHROMIUM_ARGS = [

49 ...COMMON_CHROMIUM_ARGS,

50 '--use-gl=angle',

51 '--use-angle=swiftshader',

52 '--enable-unsafe-swiftshader',

53 '--ignore-gpu-blocklist',

54];

55// Visible dev-browser sessions should use the normal GPU path instead of SwiftShader.

56exports.INTERACTIVE_CHROMIUM_ARGS = [

57 ...COMMON_CHROMIUM_ARGS,

58 '--ignore-gpu-blocklist',

59];

60// Backward-compatible alias for older imports.

61exports.CHROMIUM_ARGS = exports.HEADLESS_CHROMIUM_ARGS;

62let customLoader = null;

63const nativeImport = new Function('specifier', 'return import(specifier);');

64function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L62

65 customLoader = loader;

66}

67async function loadPlaywright() {

68 if (customLoader) {

69 return customLoader();

70 }

71 const loaderPath = process.env.PLAYDROP_PLAYWRIGHT_LOADER_PATH?.trim();

72 if (loaderPath) {

73 const loaderModule = await nativeImport((0, node_url_1.pathToFileURL)(loaderPath).href);

74 const candidate = loaderModule.loadPlaywright

75 ?? loaderModule.createPlaywrightModule

76 ?? loaderModule.default

77 ?? loaderModule;

78 if (typeof candidate === 'function') {

79 return await candidate();

80 }

81 if (candidate && typeof candidate === 'object' && typeof candidate.chromium?.launch === 'function') {

82 return candidate;

dist/apiClient.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createCliClientHeaders = createCliClientHeaders;

4exports.createCliApiClient = createCliApiClient;

5exports.createCliAiClient = createCliAiClient;

6const api_client_1 =

dist/commands/worker.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/commands/clients.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty