registry / incanto / 0.10.0

incanto@0.10.0

Vibe-coding-first web game engine SDK — JSON-driven scenes on three.js

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

Manifest

NoLicense

scanned 46 file(s), 4.18 MB of source, external domains: agent8-games.verse8.io, github.com, hacksoflife.blogspot.ch, jcgt.org, verse8-game-backend-kr-609824224664.asia-northeast3.run.app, vrm.dev, www.w3.org

Oversized source lightweight scan

editor/assets/rapier-DE6a0vmv.js2.13 MB file, sampled 256 KB

NetworkMinified

Source & flagged code

3 flagged

bin/incanto-assets.mjsView file

Lines 64-104javascript

64 console.log(JSON.stringify(entry, null, 2));

65 if (entry.animation) {

66 const meta = JSON.parse(readFileSync(join(ASSETS, entry.animation), 'utf-8'));

67 console.log('\nanimations:', Object.keys(meta.animations ?? {}).join(', '));

68 }

69 process.exitCode = 0; // see the list note — exit() truncates piped stdout

70 } else if (command === 'copy') {

71 const outFlag = rest.indexOf('--out');

72 const outDir = resolve(outFlag !== -1 ? rest[outFlag + 1] : 'public/assets');

73 mkdirSync(outDir, { recursive: true });

74 const copied = [];

75 for (const file of [entry.file, entry.animation].filter(Boolean)) {

76 const target = join(outDir, basename(file));

77 copyFileSync(join(ASSETS, file), target);

78 copied.push(target);

79 }

80 for (const t of copied) console.log(`copied ${t}`);

82 // Ready-to-paste scene JSON (sheet assets get full animation wiring).

83 const url = `assets/${basename(entry.file)}`;

84 if (entry.animation) {

85 const { spriteFromLibraryMeta } = await import(

86 pathToFileURL(join(PKG, 'dist', '2d.js')).href

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/incanto-assets.mjsView on unpkg · L84

87 );

88 const meta = JSON.parse(readFileSync(join(ASSETS, entry.animation), 'utf-8'));

89 const { asset, props } = spriteFromLibraryMeta(meta, { url, assetKey: entry.name });

90 console.log(`\nscene assets entry:\n "${entry.name}": ${JSON.stringify(asset)}`);

91 console.log(

92 `\nnode:\n ${JSON.stringify({ name: entry.name, type: 'AnimatedSprite2D', props }, null, 2)}`,

93 );

94 } else {

95 console.log(

96 `\nscene assets entry:\n "${entry.name}": ${JSON.stringify({ type: 'texture', url })}`,

97 );

98 console.log(

99 `\nnode:\n ${JSON.stringify({ name: entry.name, type: 'Sprite2D', props: { texture: `$${entry.name}` } })}`,

100 );

101 }

102 process.exitCode = 0;

103 } else {

104 console.error(`unknown command '${command}'`);

assets/audio/attacked.mp3View file

•path = assets/audio/attacked.mp3 kind = high_entropy_blob sizeBytes = 8757 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/audio/attacked.mp3View on unpkg

editor/assets/rapier-DE6a0vmv.jsView file

•path = editor/assets/rapier-DE6a0vmv.js kind = oversized_source_file sizeBytes = 2236503 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

editor/assets/rapier-DE6a0vmv.jsView on unpkg

Source & flagged code

3 flagged · loading source

bin/incanto-assets.mjsView file

84if (entry.animation) { L85: const { spriteFromLibraryMeta } = await import( L86: pathToFileURL(join(PKG, 'dist', '2d.js')).href

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/incanto-assets.mjsView on unpkg · L84

assets/audio/attacked.mp3View file

•path = assets/audio/attacked.mp3 kind = high_entropy_blob sizeBytes = 8757 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/audio/attacked.mp3View on unpkg

editor/assets/rapier-DE6a0vmv.jsView file

•path = editor/assets/rapier-DE6a0vmv.js kind = oversized_source_file sizeBytes = 2236503 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

editor/assets/rapier-DE6a0vmv.jsView on unpkg

Findings

2 High4 Medium5 Low

HighShips High Entropy Blobassets/audio/attacked.mp3

HighOversized Source Fileeditor/assets/rapier-DE6a0vmv.js

MediumDynamic Requirebin/incanto-assets.mjs

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bin/incanto-assets.mjsView file

Lines 64-104javascript

64 console.log(JSON.stringify(entry, null, 2));

65 if (entry.animation) {

66 const meta = JSON.parse(readFileSync(join(ASSETS, entry.animation), 'utf-8'));

67 console.log('\nanimations:', Object.keys(meta.animations ?? {}).join(', '));

68 }

69 process.exitCode = 0; // see the list note — exit() truncates piped stdout

70 } else if (command === 'copy') {

71 const outFlag = rest.indexOf('--out');

72 const outDir = resolve(outFlag !== -1 ? rest[outFlag + 1] : 'public/assets');

73 mkdirSync(outDir, { recursive: true });

74 const copied = [];

75 for (const file of [entry.file, entry.animation].filter(Boolean)) {

76 const target = join(outDir, basename(file));

77 copyFileSync(join(ASSETS, file), target);

78 copied.push(target);

79 }

80 for (const t of copied) console.log(`copied ${t}`);

82 // Ready-to-paste scene JSON (sheet assets get full animation wiring).

83 const url = `assets/${basename(entry.file)}`;

84 if (entry.animation) {

85 const { spriteFromLibraryMeta } = await import(

86 pathToFileURL(join(PKG, 'dist', '2d.js')).href

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/incanto-assets.mjsView on unpkg · L84

87 );

88 const meta = JSON.parse(readFileSync(join(ASSETS, entry.animation), 'utf-8'));

89 const { asset, props } = spriteFromLibraryMeta(meta, { url, assetKey: entry.name });

90 console.log(`\nscene assets entry:\n "${entry.name}": ${JSON.stringify(asset)}`);

91 console.log(

92 `\nnode:\n ${JSON.stringify({ name: entry.name, type: 'AnimatedSprite2D', props }, null, 2)}`,

93 );

94 } else {

95 console.log(

96 `\nscene assets entry:\n "${entry.name}": ${JSON.stringify({ type: 'texture', url })}`,

97 );

98 console.log(

99 `\nnode:\n ${JSON.stringify({ name: entry.name, type: 'Sprite2D', props: { texture: `$${entry.name}` } })}`,

100 );

101 }

102 process.exitCode = 0;

103 } else {

104 console.error(`unknown command '${command}'`);

assets/audio/attacked.mp3View file

•path = assets/audio/attacked.mp3 kind = high_entropy_blob sizeBytes = 8757 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/audio/attacked.mp3View on unpkg

editor/assets/rapier-DE6a0vmv.jsView file

•path = editor/assets/rapier-DE6a0vmv.js kind = oversized_source_file sizeBytes = 2236503 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

editor/assets/rapier-DE6a0vmv.jsView on unpkg