registry / mobai-lv-build-runner / 0.0.1-alpha.27

mobai-lv-build-runner@0.0.1-alpha.27

Internal Lunaverse build runner

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 26 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 585 file(s), 12.3 MB of source, external domains: developer.imaginationtech.com, docs.cocos.com, download.cocos.com, forum.cocos.org, gitee.com, github.com, imagemagick.org, json.schemastore.org, people.mozilla.org, rbuckton.github.io, repo.harmonyos.com, tc39.github.io, www.apache.org

Source & flagged code

18 flagged

package.jsonView file

Lines 21-61json

21 "test:quiet": "jest --silent",

22 "test:watch": "jest --watch",

23 "test:coverage": "jest --coverage",

24 "test:e2e": "node e2e/scripts/prepare-test.js",

25 "test:e2e:debug": "node e2e/scripts/prepare-test.js --preserve --verbose --no-cache",

26 "test:all": "npm run test && npm run test:e2e",

27 "check:e2e-coverage": "tsx e2e/scripts/check-coverage.ts",

28 "check:e2e-coverage:report": "tsx e2e/scripts/check-coverage.ts --save",

29 "generate:mcp-types": "node --max-old-space-size=4096 node_modules/tsx/dist/cli.mjs e2e/scripts/generate-mcp-types.ts",

30 "generate:dts": "tsx workflow/generate-dts.ts",

31 "install:engine": "cd ./packages/engine && npm i",

32 "setup:runtime-engine": "node workflow/setup-runtime-engine.js",

33 "compiler": "FORCE_UPDATE=true npm i",

34 "compiler:engine": "node --max-old-space-size=8192 workflow/compiler-engine.js --force",

35 "build:cc-module": "node workflow/build-cc-module.js",

36 "build:static-web": "node workflow/build-scene-bundle.js && node workflow/build-polyfills.js",

37 "build": "npm run build:clear && node workflow/prepare-dts.js && tsc -b && npm run build:static-web && node workflow/generate-schema.js",

38 "compile": "npm run build:clear && node workflow/prepare-dts.js && tsc -b && npm run build:static-web && node workflow/generate-schema.js",

39 "build:clear": "node workflow/build-clear.js",

40 "build:watch": "tsc -b --watch",

41 "postinstall": "node workflow/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "download-tools": "node workflow/download-tools.js",

43 "pack:script": "node workflow/pack-scripts.js",

44 "release": "npx --yes gulp release --gulpfile workflow/release.js",

45 "start:mcp-debug": "node ./dist/cli.js start-mcp-server --project=./tests/fixtures/projects/asset-operation",

46 "start:preview": "node ./dist/cli.js preview --project=./tests/fixtures/projects/asset-operation",

47 "start:mcp-inspector": "npx @modelcontextprotocol/inspector",

48 "cli": "node ./dist/cli.js",

49 "rebuild": "node workflow/electron-rebuild.js"

50 },

51 "author": "MobAI",

52 "files": [

53 "bin",

54 "dist",

55 "static/assets",

56 "static/build-templates",

57 "static/i18n",

58 "static/logo",

59 "static/scripting",

60 "static/web",

61 "repo.json",

•Runtime dependency names matching Node built-ins: readline

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/core/builder/platforms/android/i18n/en.jsView file

Lines 12-52javascript

12 portrait: 'Portrait',

13 keystore: 'Keystore',

14 use_debug_keystore: 'Use the debug keystore',

15 render_back_end: 'Render BackEnd',

16 intent_filter: 'Intent filter',

17 swappy

dist/core/scripting/compile-process.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.startCompileScriptProcess = startCompileScriptProcess;

4const path_1 = require("path");

5const child_process_1 =

workflow/generate-dts.tsView file

Lines 1-34typescript

2import * as path from 'path';

3import * as fs from 'fs-extra';

4import {

5 Extractor,

6 ExtractorConfig,

7 ExtractorResult,

8 IConfigFile,

dist/core/builder/worker/builder/asset-handler/texture-compress/compress-tool.jsView file

Lines 306-346javascript

306/**

307 * 根据图片类型获取压缩函数

308 * @param format

309 */

310function getCompressFunc(format) {

311 const start = format.slice(0, 3);

dist/core/configuration/index.jsView file

Lines 1-25javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

dist/core/builder/worker/builder/utils/index.jsView file

Lines 45-85javascript

45exports.dbUrlToRawPath = dbUrlToRawPath;

46exports.relativeUrl = relativeUrl;

47exports.isInstallNodeJs = isInstallNodeJs;

48exports.getFileSizeDeep = getFileSizeDeep;

49exports.copyDirSync = copyDirSync;

50exports.compressUuid = compressUuid;

workflow/electron-rebuild.jsView file

13console.log(`\n> ${cmd}`); L14: execSync(cmd, { stdio: 'inherit' }); L15: } ... L17: try { L18: run('npx --yes patch-package'); L19: run(`npx @electron/rebuild --force --version ${electronVersion}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

workflow/electron-rebuild.jsView on unpkg · L13

packages/engine-cache/dev-cli-runtime-cache.tgzView file

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = high_entropy_blob sizeBytes = 14782689 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = compressed_blob sizeBytes = 14782689 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = nested_archive_needs_inspection sizeBytes = 14782689 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

dist/core/builder/platforms/google-play/i18n/en.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = confirm_...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L28

30patternName = generic_password severity = medium line = 30 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L30

33patternName = generic_password severity = medium line = 33 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L33

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node workflow/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: readline

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.postinstall = node workflow/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/builder/platforms/android/i18n/en.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = confirm_...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/builder/platforms/android/i18n/en.jsView on unpkg · L32

34patternName = generic_password severity = medium line = 34 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/android/i18n/en.js

dist/core/builder/platforms/android/i18n/en.jsView on unpkg · L34

37patternName = generic_password severity = medium line = 37 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/android/i18n/en.js

dist/core/builder/platforms/android/i18n/en.jsView on unpkg · L37

dist/core/scripting/compile-process.jsView file

4const path_1 = require("path"); L5: const child_process_1 = require("child_process"); L6: /**

High

Child Process

Package source references child process execution.

dist/core/scripting/compile-process.jsView on unpkg · L4

workflow/generate-dts.tsView file

14L15: const execAsync = promisify(exec);// Dynamically build the real PlatformType union from @cocos/ccbuild enums. L16: // This is needed because api-extractor incorrectly resolves

High

Shell

Package source references shell execution.

workflow/generate-dts.tsView on unpkg · L14

dist/core/builder/worker/builder/asset-handler/texture-compress/compress-tool.jsView file

326function patchCommand(command, options) { L327: return new Function('options', 'with(options){ return String.raw`' + command + '`}')(options); L328: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/builder/worker/builder/asset-handler/texture-compress/compress-tool.jsView on unpkg · L326

dist/core/configuration/index.jsView file

17exports.getCocosConfigNodes = exports.configurationManager = exports.configurationRegistry = void 0; L18: const registry_1 = require("./script/registry"); L19: Object.defineProperty(exports, "configurationRegistry", { enumerable: true, get: function () { return registry_1.configurationRegistry; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/configuration/index.jsView on unpkg · L17

dist/core/builder/worker/builder/utils/index.jsView file

65const path_1 = require("path"); L66: const child_process_1 = require("child_process"); L67: const fs_1 = require("fs"); ... L184: (0, child_process_1.exec)('node -v', { L185: env: process.env, L186: }, (error) => { ... L447: } L448: //# sourceMappingURL=data:application/json;base64,[redacted]...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/builder/worker/builder/utils/index.jsView on unpkg · L65

workflow/electron-rebuild.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

workflow/electron-rebuild.jsView on unpkg · L13

packages/engine-cache/dev-cli-runtime-cache.tgzView file

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = high_entropy_blob sizeBytes = 14782689 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = compressed_blob sizeBytes = 14782689 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = nested_archive_needs_inspection sizeBytes = 14782689 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

dist/core/builder/platforms/google-play/i18n/en.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = confirm_...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L28

30patternName = generic_password severity = medium line = 30 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L30

33patternName = generic_password severity = medium line = 33 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L33

Findings

6 High12 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/scripting/compile-process.js

HighShellworkflow/generate-dts.ts

HighRuntime Package Installworkflow/electron-rebuild.js

HighShips High Entropy Blobpackages/engine-cache/dev-cli-runtime-cache.tgz

HighNode Builtin Dependency Squatpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/core/builder/platforms/android/i18n/en.js

MediumDynamic Requiredist/core/configuration/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobpackages/engine-cache/dev-cli-runtime-cache.tgz

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/core/builder/platforms/android/i18n/en.js

MediumSecret Patterndist/core/builder/platforms/google-play/i18n/en.js

LowScripts Present

LowEvaldist/core/builder/worker/builder/asset-handler/texture-compress/compress-tool.js

LowWeak Cryptodist/core/builder/worker/builder/utils/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionpackages/engine-cache/dev-cli-runtime-cache.tgz

Source & flagged code

18 flagged

package.jsonView file

Lines 21-61json

21 "test:quiet": "jest --silent",

22 "test:watch": "jest --watch",

23 "test:coverage": "jest --coverage",

24 "test:e2e": "node e2e/scripts/prepare-test.js",

25 "test:e2e:debug": "node e2e/scripts/prepare-test.js --preserve --verbose --no-cache",

26 "test:all": "npm run test && npm run test:e2e",

27 "check:e2e-coverage": "tsx e2e/scripts/check-coverage.ts",

28 "check:e2e-coverage:report": "tsx e2e/scripts/check-coverage.ts --save",

29 "generate:mcp-types": "node --max-old-space-size=4096 node_modules/tsx/dist/cli.mjs e2e/scripts/generate-mcp-types.ts",

30 "generate:dts": "tsx workflow/generate-dts.ts",

31 "install:engine": "cd ./packages/engine && npm i",

32 "setup:runtime-engine": "node workflow/setup-runtime-engine.js",

33 "compiler": "FORCE_UPDATE=true npm i",

34 "compiler:engine": "node --max-old-space-size=8192 workflow/compiler-engine.js --force",

35 "build:cc-module": "node workflow/build-cc-module.js",

36 "build:static-web": "node workflow/build-scene-bundle.js && node workflow/build-polyfills.js",

37 "build": "npm run build:clear && node workflow/prepare-dts.js && tsc -b && npm run build:static-web && node workflow/generate-schema.js",

38 "compile": "npm run build:clear && node workflow/prepare-dts.js && tsc -b && npm run build:static-web && node workflow/generate-schema.js",

39 "build:clear": "node workflow/build-clear.js",

40 "build:watch": "tsc -b --watch",

41 "postinstall": "node workflow/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "download-tools": "node workflow/download-tools.js",

43 "pack:script": "node workflow/pack-scripts.js",

44 "release": "npx --yes gulp release --gulpfile workflow/release.js",

45 "start:mcp-debug": "node ./dist/cli.js start-mcp-server --project=./tests/fixtures/projects/asset-operation",

46 "start:preview": "node ./dist/cli.js preview --project=./tests/fixtures/projects/asset-operation",

47 "start:mcp-inspector": "npx @modelcontextprotocol/inspector",

48 "cli": "node ./dist/cli.js",

49 "rebuild": "node workflow/electron-rebuild.js"

50 },

51 "author": "MobAI",

52 "files": [

53 "bin",

54 "dist",

55 "static/assets",

56 "static/build-templates",

57 "static/i18n",

58 "static/logo",

59 "static/scripting",

60 "static/web",

61 "repo.json",

•Runtime dependency names matching Node built-ins: readline

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/core/builder/platforms/android/i18n/en.jsView file

Lines 12-52javascript

12 portrait: 'Portrait',

13 keystore: 'Keystore',

14 use_debug_keystore: 'Use the debug keystore',

15 render_back_end: 'Render BackEnd',

16 intent_filter: 'Intent filter',

17 swappy

dist/core/scripting/compile-process.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.startCompileScriptProcess = startCompileScriptProcess;

4const path_1 = require("path");

5const child_process_1 =

workflow/generate-dts.tsView file

Lines 1-34typescript

2import * as path from 'path';

3import * as fs from 'fs-extra';

4import {

5 Extractor,

6 ExtractorConfig,

7 ExtractorResult,

8 IConfigFile,

dist/core/builder/worker/builder/asset-handler/texture-compress/compress-tool.jsView file

Lines 306-346javascript

306/**

307 * 根据图片类型获取压缩函数

308 * @param format

309 */

310function getCompressFunc(format) {

311 const start = format.slice(0, 3);

dist/core/configuration/index.jsView file

Lines 1-25javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

dist/core/builder/worker/builder/utils/index.jsView file

Lines 45-85javascript

45exports.dbUrlToRawPath = dbUrlToRawPath;

46exports.relativeUrl = relativeUrl;

47exports.isInstallNodeJs = isInstallNodeJs;

48exports.getFileSizeDeep = getFileSizeDeep;

49exports.copyDirSync = copyDirSync;

50exports.compressUuid = compressUuid;

workflow/electron-rebuild.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

workflow/electron-rebuild.jsView on unpkg · L13

packages/engine-cache/dev-cli-runtime-cache.tgzView file

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = high_entropy_blob sizeBytes = 14782689 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = compressed_blob sizeBytes = 14782689 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

•path = packages/engine-cache/dev-cli-runtime-cache.tgz kind = nested_archive_needs_inspection sizeBytes = 14782689 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

packages/engine-cache/dev-cli-runtime-cache.tgzView on unpkg

dist/core/builder/platforms/google-play/i18n/en.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = confirm_...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L28

30patternName = generic_password severity = medium line = 30 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L30

33patternName = generic_password severity = medium line = 33 matchedText = keystore...rd',

Medium

Secret Pattern

Hardcoded password in dist/core/builder/platforms/google-play/i18n/en.js

dist/core/builder/platforms/google-play/i18n/en.jsView on unpkg · L33