@spup/game-server@2.9.0
Discontinued
The Shy's Power-Up Factory server, its base mods, and the harness a mod's tests run against
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe game server automatically reports runtime errors to a fixed endpoint, including stack traces and, in some cases, player IDs. This undisclosed collection of identifying diagnostic details is suspicious telemetry; the flagged child-process launch itself is part of an explicitly invoked dev-server function.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The game server starts, then encounters an uncaught error, failed message dispatch, or save failure.
Impact
Runtime diagnostics may expose local paths, error data, and player identifiers to the reporting service.
Mechanism
The server posts error messages, stack traces, its origin URL, and optional context such as a player ID to a fixed HTTPS endpoint.
AI rationale
The game server automatically reports runtime errors to a fixed endpoint, including stack traces and, in some cases, player IDs. This undisclosed collection of identifying diagnostic details is suspicious telemetry; the flagged child-process launch itself is part of an explicitly invoked dev-server function.
Evidence
dist/main.js
Network endpoints1
bugs.spupgame.com/report
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The server installs a crash reporter automatically at startup and sends reports to https://bugs.spupgame.com/report.
- Reports include error messages, stack traces, the server origin and optional extra fields; message-dispatch errors add a player ID.
- The exported dev launcher starts a child game-server process when startDevGameServer() is called.
Evidence against
- The child process launch is part of the explicit dev-server start function, not an install hook.
- The inspected source shows no credential collection or forwarding.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
GitDependency
Source & flagged code
5 flaggedlib/devGameServer.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @spup/game-server@2.0.0
matchedIdentity = npm:QHNwdXAvZ2FtZS1zZXJ2ZXI:2.0.0
similarity = 0.417
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/devGameServer.jsView on unpkg4L5: import {spawn} from "node:child_process";
L6: import {mkdirSync} from "node:fs";
High
Child Process
Package source references child process execution.
lib/devGameServer.jsView on unpkg · L44Cross-file remote execution chain: lib/devGameServer.js spawns dist/main.js; helper contains network access plus dynamic code execution.
L4:
L5: import {spawn} from "node:child_process";
L6: import {mkdirSync} from "node:fs";
...
L17: // same auth server the official client signs in to.
L18: export const DEFAULT_AUTH_SERVER = "https://auth.spupgame.com";
L19:
...
L85: * @returns {void}
L86: * @private
L87: */
High
Findings
1 Critical2 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/devGameServer.js
HighChild Processlib/devGameServer.js
HighCross File Remote Execution Contextlib/devGameServer.js
MediumDynamic Requiredist/main.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumAi Review Evidencedist/main.js
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @spup/game-server@2.9.0.
See all versions of @spup/game-server for other recorded verdicts.
- Review the evidence and your use of @spup/game-server@2.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.