registry / @spup/game-server

@spup/game-server

⚠ Under review

Discontinued

The Shy's Power-Up Factory server, its base mods, and the harness a mod's tests run against

This report shows the evidence for @spup/game-server@2.10.3. 0 of 11 known versions are blocked or flagged. See all versions.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 13 file(s), 1.61 MB of source, external domains: auth.spupgame.com, bugs.spupgame.com, www.codeandweb.com

Source & flagged code

4 flagged

dist/main.jsView file

9528}; L9529: Writer.prototype.fork = function fork() { L9530: this.states = new State(this);

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L9528

56*/ L57: require(itemType) { L58: const definition = this._byType.get(itemType);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L56

lib/devGameServer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @spup/game-server@2.0.0 matchedIdentity = npm:QHNwdXAvZ2FtZS1zZXJ2ZXI:2.0.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Findings

1 Critical3 High4 Medium3 Low

CriticalPrevious Version Dangerous Deltalib/devGameServer.js

HighChild Processdist/main.js

HighShell

HighCross File Remote Execution Contextlib/devGameServer.js

MediumDynamic Requiredist/main.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @spup/game-server@2.10.3.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @spup/game-server@2.10.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 02:57:21.406Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

2.10.3latestshownSuspicious—WarnUnder ReviewAug 27, 2026, 2:17 AM 2.10.2SuspiciousTelemetryWarnPublishedAug 26, 2026, 11:14 PM 2.9.0SuspiciousTelemetryWarnPublishedAug 25, 2026, 12:51 PM 2.8.0Suspicious—WarnUnder ReviewAug 21, 2026, 10:45 PM

registry / @spup/game-server

@spup/game-server

⚠ Under review

Discontinued

The Shy's Power-Up Factory server, its base mods, and the harness a mod's tests run against

This report shows the evidence for @spup/game-server@2.10.3. 0 of 11 known versions are blocked or flagged. See all versions.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 13 file(s), 1.61 MB of source, external domains: auth.spupgame.com, bugs.spupgame.com, www.codeandweb.com

Source & flagged code

4 flagged

dist/main.jsView file

9528}; L9529: Writer.prototype.fork = function fork() { L9530: this.states = new State(this);

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L9528

56*/ L57: require(itemType) { L58: const definition = this._byType.get(itemType);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L56

lib/devGameServer.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Findings

1 Critical3 High4 Medium3 Low

CriticalPrevious Version Dangerous Deltalib/devGameServer.js

HighChild Processdist/main.js

HighShell

HighCross File Remote Execution Contextlib/devGameServer.js

MediumDynamic Requiredist/main.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @spup/game-server@2.10.3.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @spup/game-server@2.10.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 02:57:21.406Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions