registry  /  hayao  /  0.3.0

hayao@0.3.0

An AI-first game engine: a deterministic, headless-native simulation kernel with a Godot-style scene tree, pluggable renderers (SVG/Canvas/headless), and a built-in verification harness — designed so an LLM can author, test, and prove correct a whole game

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 9 file(s), 2.28 MB of source, external domains: fb.me, github.com, json-schema.org, raw.githubusercontent.com, react.dev, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

4 flagged · loading source
bin/hayao-mcp-cli.mjsView file
5// { "mcpServers": { "hayao-studio": { "command": "npx", "args": ["hayao-mcp"] } } } L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';
High
Child Process

Package source references child process execution.

bin/hayao-mcp-cli.mjsView on unpkg · L5
9const server = fileURLToPath(new URL('../dist/mcp.js', import.meta.url)); L10: const child = spawn('npx', ['tsx', server], { stdio: 'inherit' }); L11: child.on('exit', (code) => process.exit(code ?? 0));
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/hayao-mcp-cli.mjsView on unpkg · L9
dist/mcp.jsView file
6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: try {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/mcp.jsView on unpkg · L6
2944sourceCode = this.opts.code.process(sourceCode, sch); L2945: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2946: const validate = makeValidate(this, this.scope.get());
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L2944

Findings

3 High3 Medium7 Low
HighChild Processbin/hayao-mcp-cli.mjs
HighShell
HighRuntime Package Installbin/hayao-mcp-cli.mjs
MediumDynamic Requiredist/mcp.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings