Loading npm security reports…

@playdrop/playdrop-cli@0.12.34: Suspicious npm security report | LPM Firewall

registry / @playdrop/playdrop-cli / 0.12.34

@playdrop/playdrop-cli@0.12.34

Official Playdrop CLI for publishing browser games, creator apps, and AI-generated game assets on playdrop.ai

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 86 file(s), 1.42 MB of source, external domains: 127.0.0.1, ai.blue.playdrop.ai, ai.green.playdrop.ai, ai.localhost, ai.playdrop.ai, ai.preview.playdrop.ai, api.blue.playdrop.ai, api.green.playdrop.ai, api.openai.com, api.playdrop.ai, api.preview.playdrop.ai, assets-local.playdrop.ai, assets.playdrop.ai, blue.playdrop.ai, github.com, green.playdrop.ai, playdrop.ai, preview.playdrop.ai, raw.githubusercontent.com, slack.com, www.localhost, www.playdrop.ai, www.w3.org

Source & flagged code

4 flagged

dist/playwright.jsView file

Lines 47-87javascript

47 '--no-sandbox',

48 '--disable-web-security',

49];

50// Force software WebGL for headless capture so local preview output stays stable.

51exports.HEADLESS_CHROMIUM_ARGS = [

52 ...COMMON_CHROMIUM_ARGS,

53 '--use-gl=angle',

54 '--use-angle=swiftshader',

55 '--enable-unsafe-swiftshader',

56 '--ignore-gpu-blocklist',

57];

58// Visible dev-browser sessions should use the normal GPU path instead of SwiftShader.

59exports.INTERACTIVE_CHROMIUM_ARGS = [

60 ...COMMON_CHROMIUM_ARGS,

61 '--ignore-gpu-blocklist',

62];

63// Deterministic project checks must exercise the installed Chrome GPU path.

64exports.INSTALLED_CHROME_ARGS = exports.INTERACTIVE_CHROMIUM_ARGS;

65// Backward-compatible alias for older imports.

66exports.CHROMIUM_ARGS = exports.HEADLESS_CHROMIUM_ARGS;

67let customLoader = null;

68const nativeImport = new Function('specifier', 'return import(specifier);');

69function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L67

70 customLoader = loader;

71}

72async function loadPlaywright() {

73 if (customLoader) {

74 return customLoader();

75 }

76 const loaderPath = process.env.PLAYDROP_PLAYWRIGHT_LOADER_PATH?.trim();

77 if (loaderPath) {

78 const loaderModule = await nativeImport((0, node_url_1.pathToFileURL)(loaderPath).href);

79 const candidate = loaderModule.loadPlaywright

80 ?? loaderModule.createPlaywrightModule

81 ?? loaderModule.default

82 ?? loaderModule;

83 if (typeof candidate === 'function') {

84 return await candidate();

85 }

86 if (candidate && typeof candidate === 'object' && typeof candidate.chromium?.launch === 'function') {

87 return candidate;

dist/apiClient.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createCliClientHeaders = createCliClientHeaders;

4exports.createCliApiClient = createCliApiClient;

5exports.createCliAiClient =

dist/commands/worker.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/commands/clients.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

Source & flagged code

4 flagged · loading source

Source & flagged code

4 flagged

dist/playwright.jsView file

Lines 47-87javascript

47 '--no-sandbox',

48 '--disable-web-security',

49];

50// Force software WebGL for headless capture so local preview output stays stable.

51exports.HEADLESS_CHROMIUM_ARGS = [

52 ...COMMON_CHROMIUM_ARGS,

53 '--use-gl=angle',

54 '--use-angle=swiftshader',

55 '--enable-unsafe-swiftshader',

56 '--ignore-gpu-blocklist',

57];

58// Visible dev-browser sessions should use the normal GPU path instead of SwiftShader.

59exports.INTERACTIVE_CHROMIUM_ARGS = [

60 ...COMMON_CHROMIUM_ARGS,

61 '--ignore-gpu-blocklist',

62];

63// Deterministic project checks must exercise the installed Chrome GPU path.

64exports.INSTALLED_CHROME_ARGS = exports.INTERACTIVE_CHROMIUM_ARGS;

65// Backward-compatible alias for older imports.

66exports.CHROMIUM_ARGS = exports.HEADLESS_CHROMIUM_ARGS;

67let customLoader = null;

68const nativeImport = new Function('specifier', 'return import(specifier);');

69function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L67

70 customLoader = loader;

71}

72async function loadPlaywright() {

73 if (customLoader) {

74 return customLoader();

75 }

76 const loaderPath = process.env.PLAYDROP_PLAYWRIGHT_LOADER_PATH?.trim();

77 if (loaderPath) {

78 const loaderModule = await nativeImport((0, node_url_1.pathToFileURL)(loaderPath).href);

79 const candidate = loaderModule.loadPlaywright

80 ?? loaderModule.createPlaywrightModule

81 ?? loaderModule.default

82 ?? loaderModule;

83 if (typeof candidate === 'function') {

84 return await candidate();

85 }

86 if (candidate && typeof candidate === 'object' && typeof candidate.chromium?.launch === 'function') {

87 return candidate;

dist/apiClient.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createCliClientHeaders = createCliClientHeaders;

4exports.createCliApiClient = createCliApiClient;

5exports.createCliAiClient =

dist/commands/worker.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/commands/clients.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code