drgame-cc-3@1.0.9
道然游戏适配包
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source shows automatic runtime reporting to the vendor analytics endpoint when the host game initializes the SDK, with user/device information in the payload and no evident opt-out. Reporting is a documented SDK feature, so this is a warning-level telemetry concern rather than evidence of malware.
Static reason
One or more suspicious static signals were detected.
Trigger
The host game calls PlatformAdapter.init, which initializes AdSdk.
Impact
App-start and associated user/device telemetry is sent to the vendor analytics service; no disable option was found in the reporter configuration.
Mechanism
AdSdk initializes the reporter with default settings and immediately reports an app-start event to the configured default endpoint, including user/device information and event data.
AI rationale
The source shows automatic runtime reporting to the vendor analytics endpoint when the host game initializes the SDK, with user/device information in the payload and no evident opt-out. Reporting is a documented SDK feature, so this is a warning-level telemetry concern rather than evidence of malware.
Evidence
drscript/PlatformAdapter.tsdrscript/ad-sdk/ad-sdk.tsdrscript/ad-sdk/reporters/reporter.tsdrscript/ad-sdk/reporters/superset-lewo.ts
Network endpoints1
sup.daoran.tv/bi-api/api/game/lewo/batch
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- AdSdk initialization automatically initializes reporting and sends an app-start event.
- The default report endpoint is sup.daoran.tv, and report requests include user/device information and event data.
- The reporter has no evident disable option in its configuration.
Evidence against
- The package documents gameplay reporting as part of its SDK API.
- The postinstall script copies package assets into the host Cocos project, as described in the README.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js && echo '完成'
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js && echo '完成'
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdrscript/ad-sdk/ad-sdk.tsView file
154// 自动初始化数据上报模块（传入 reporter 配置，无配置时使用空对象默认初始化）
Reporter.init(config.reporter || {});
this._initialized = true;
console.log('[AdSdk] Initialized with platform: '
Medium
Ai Review Evidence
AdSdk initialization automatically initializes reporting and sends an app-start event.
drscript/ad-sdk/ad-sdk.tsFindings
1 High7 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumAi Review Evidencedrscript/ad-sdk/ad-sdk.ts
MediumAi Review Evidencedrscript/ad-sdk/ad-sdk.ts
MediumAi Review Evidencedrscript/ad-sdk/reporters/superset-lewo.ts
MediumAi Review Evidencedrscript/ad-sdk/reporters/superset-lewo.ts
MediumAi Review Evidencedrscript/README.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to drgame-cc-3@1.0.9.
See all versions of drgame-cc-3 for other recorded verdicts.
- Review the evidence and your use of drgame-cc-3@1.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.