drgame-cc-3@1.0.2
道然游戏适配包
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe source shows conditional token forwarding to an unrestricted runtime-configurable endpoint, which warrants a warning under the credential-forwarding policy. The game-related default endpoint and asset installer fit the package's apparent role, and no independent evidence establishes a concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The consumer starts the virtual gamepad; the asset copy runs during npm postinstall.
Impact
A token may reach an unintended endpoint if runtime configuration selects one. The postinstall copy can replace existing project assets and templates.
Mechanism
The gamepad reads a token from runtime state or local storage and attaches it to the connection URL; the destination can be overridden at runtime. The postinstall script overwrites matching project files while copying package resources.
AI rationale
The source shows conditional token forwarding to an unrestricted runtime-configurable endpoint, which warrants a warning under the credential-forwarding policy. The game-related default endpoint and asset installer fit the package's apparent role, and no independent evidence establishes a concrete attack.
Evidence
build-templatesassets/resources/drresassets/drscript
Network endpoints1
wss://hyp.huyingpai.com/huyingpai/lewo/ws
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook copies the package's Cocos templates and assets into the host project, matching its stated game-adapter role.
- VirtualGamepad reads a runtime token and accepts a runtime-configured WebSocket URL.
- Starting the virtual gamepad connects to that URL and sends the token as a query parameter without a destination allowlist.
Evidence against
- The WebSocket client is part of the virtual gamepad feature and uses a package-configured production service by default.
- No package-controlled unrelated recipient or other concrete malicious behavior was established.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js && echo '完成'
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js && echo '完成'
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg10"scripts": {
"postinstall": "node scripts/postinstall.js && echo '完成'"
},
"keywords": [
"cocos
Medium
Suspicious Lifecycle Evidence
The postinstall hook copies the package's Cocos templates and assets into the host project, matching its stated game-adapter role.
package.jsonView on unpkg · L10scripts/postinstall.jsView file
Findings
1 High7 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencescripts/postinstall.js
MediumAi Review Evidencedrscript/virtualgamepad/VirtualGamepad.ts
MediumAi Review Evidencedrscript/virtualgamepad/VirtualGamepad.ts
MediumAi Review Evidencedrscript/virtualgamepad/VirtualGamepad.ts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to drgame-cc-3@1.0.2.
See all versions of drgame-cc-3 for other recorded verdicts.
- Review the evidence and your use of drgame-cc-3@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.