registry / gamegold / 6.7.9

gamegold@6.7.9

⚠ Under review

Vallnet Core for Wallet

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 2.36 MB of source, external domains: 50btc.com, api.blockcypher.com, api.smartbit.com.au, bcpool.io, bitcointalk.org, bitfury.org, bitmaintech.com, bitminter.com, bitparking.com, blockchain.info, chain.api.btc.com, chain.so, cointerra.com, eclipsemc.com, eligius.st, explorer.bitcoin.com, f2pool.com, feross.org, ghash.io, gitee.com, github.com, give-me-coins.com, hhtt.1209k.com, insight.gamegold.xin, megabigpower.com, mtred.com, multicoin.co, nmcbit.com, ozco.in, polmine.pl, pool.btcc.com, pool.btcchina.com, registry.npmmirror.com, simplecoin.us, slushpool.com, socket.io, tchain.api.btc.com, testnet-api.smartbit.com.au, wizkid057.com, www.175btc.com, www.bitstamp.net, www.btcguild.com, www.kncminer.com, www.maxbtc.com, www.triplemining.com, www.w3.org, yourbtc.net

Oversized source lightweight scan

lib/gamegold.js2.48 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsMinifiedUrlStrings50btc.combcpool.iobitcointalk.orgbitfury.orgbitmaintech.combitminter.combitparking.comcointerra.comeclipsemc.comeligius.stf2pool.comghash.iogithub.comgive-me-coins.comhhtt.1209k.cominsight.gamegold.xinmegabigpower.commtred.commulticoin.conmcbit.comozco.inpolmine.plpool.btcc.compool.btcchina.com

Source & flagged code

8 flagged

package.jsonView file

Lines 21-44json

21 "wallet"

22 ],

23 "engines": {

24 "node": ">=14.15.4"

25 },

26 "dependencies": {},

27 "optionalDependencies": {},

28 "devDependencies": {},

29 "main": "./lib/gamegold.js",

30 "bin": {

31 "vc": "./bin/cli",

32 "vn": "./bin/node"

33 },

34 "scripts": {

35 "start": "node bin/node --genesis --network=testnet --phrase=bookmansoft",

36 "cli": "node bin/cli",

37 "pre": "npm install --registry=https://registry.npmmirror.com",

38 "auto": "pm2 startOrRestart pm2.config.js & pm2 monit",

39 "log": "pm2 startOrRestart pm2.config.js & pm2 log",

40 "stop": "pm2 delete pm2.config.js",

41 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

lib/gamegold-worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gamegold@6.7.8 matchedIdentity = npm:Z2FtZWdvbGQ:6.7.8 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/gamegold-worker.jsView on unpkg

423*/ L424: let r=i(0);i=i(57);let a=t;a.HARDENED=2147483648,a.MIN_ENTROPY=128,a.MAX_ENTROPY=512,a.cache=new i(500),a.parsePath=function(e,t){r("string"==typeof e),r("boolean"==typeof t),r(1<=... L425: /*!

High

Child Process

Package source references child process execution.

lib/gamegold-worker.jsView on unpkg · L423

610* Ported from: L611: * https://github.[redacted].cpp L612: */ ... L623: */ L624: let r=i(0);var a=i(11);let s=i(91),n=i(2),o=i(24),d=i(13),p=i(425),h=i(134),l=i(202),c=i(203),u=i(105);var{}=i(5);class f extends a{constructor(e){super(),this.id=-1,this.framer=ne... L625: /*!

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/gamegold-worker.jsView on unpkg · L610

helper/bundle.jsView file

1!function i(a,s,c){function u(t,e){if(!s[t]){if(!a[t]){var n="function"==typeof require&&require;if(!e&&n)return n(t,!0);if(l)return l(t,!0);var r=new Error("Cannot find module '"+...

High

Shell

Package source references shell execution.

helper/bundle.jsView on unpkg · L1

lib/3e5859b6ed61c4e6d40766d31d235bb6.nodeView file

•path = [redacted].node kind = native_binary sizeBytes = 660480 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/3e5859b6ed61c4e6d40766d31d235bb6.nodeView on unpkg

lib/gamegold.jsView file

•path = lib/gamegold.js kind = oversized_source_file sizeBytes = 2600664 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/gamegold.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/gamegold-worker.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/gamegold-worker.jsView on unpkg

High

Child Process

Package source references child process execution.

lib/gamegold-worker.jsView on unpkg · L423

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/gamegold-worker.jsView on unpkg · L610

helper/bundle.jsView file

1!function i(a,s,c){function u(t,e){if(!s[t]){if(!a[t]){var n="function"==typeof require&&require;if(!e&&n)return n(t,!0);if(l)return l(t,!0);var r=new Error("Cannot find module '"+...

High

Shell

Package source references shell execution.

helper/bundle.jsView on unpkg · L1

lib/3e5859b6ed61c4e6d40766d31d235bb6.nodeView file

•path = [redacted].node kind = native_binary sizeBytes = 660480 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/3e5859b6ed61c4e6d40766d31d235bb6.nodeView on unpkg

lib/gamegold.jsView file

•path = lib/gamegold.js kind = oversized_source_file sizeBytes = 2600664 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/gamegold.jsView on unpkg

Findings

1 Critical5 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltalib/gamegold-worker.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processlib/gamegold-worker.js

HighShellhelper/bundle.js

HighCommand Output Exfiltrationlib/gamegold-worker.js

HighOversized Source Filelib/gamegold.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarylib/3e5859b6ed61c4e6d40766d31d235bb6.node

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 21-44json

21 "wallet"

22 ],

23 "engines": {

24 "node": ">=14.15.4"

25 },

26 "dependencies": {},

27 "optionalDependencies": {},

28 "devDependencies": {},

29 "main": "./lib/gamegold.js",

30 "bin": {

31 "vc": "./bin/cli",

32 "vn": "./bin/node"

33 },

34 "scripts": {

35 "start": "node bin/node --genesis --network=testnet --phrase=bookmansoft",

36 "cli": "node bin/cli",

37 "pre": "npm install --registry=https://registry.npmmirror.com",

38 "auto": "pm2 startOrRestart pm2.config.js & pm2 monit",

39 "log": "pm2 startOrRestart pm2.config.js & pm2 log",

40 "stop": "pm2 delete pm2.config.js",

41 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

lib/gamegold-worker.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/gamegold-worker.jsView on unpkg

High

Child Process

Package source references child process execution.

lib/gamegold-worker.jsView on unpkg · L423

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/gamegold-worker.jsView on unpkg · L610

helper/bundle.jsView file

1!function i(a,s,c){function u(t,e){if(!s[t]){if(!a[t]){var n="function"==typeof require&&require;if(!e&&n)return n(t,!0);if(l)return l(t,!0);var r=new Error("Cannot find module '"+...

High

Shell

Package source references shell execution.

helper/bundle.jsView on unpkg · L1

lib/3e5859b6ed61c4e6d40766d31d235bb6.nodeView file

•path = [redacted].node kind = native_binary sizeBytes = 660480 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/3e5859b6ed61c4e6d40766d31d235bb6.nodeView on unpkg

lib/gamegold.jsView file

•path = lib/gamegold.js kind = oversized_source_file sizeBytes = 2600664 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/gamegold.jsView on unpkg