registry / romdevtools / 0.91.0

romdevtools@0.91.0

Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator co

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 3.20 MB of source, external domains: github.com, lospec.com, www.pico-8.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

2 "name": "romdevtools",

3 "version": "0.91.0",

4 "description": "Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator cores. Use over plain HTTP, as an Agent Skill, or as an MCP server.",

5 "type": "module",

6 "main": "src/mcp/server.js",

7 "bin": {

8 "romdevtools": "src/mcp/server.js",

9 "romdev-mcp": "src/mcp/server.js",

10 "romdevtools-cli": "src/cli/smoke.js"

11 },

12 "scripts": {

13 "postinstall": "node src/install/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "smoke": "node --enable-source-maps src/cli/smoke.js",

15 "mcp": "node --enable-source-maps src/mcp/server.js",

16 "test": "node --test 'src/**/*.test.js' 'test/**/*.test.js'"

17 },

18 "keywords": [

19 "mcp",

20 "model-context-protocol",

21 "libretro",

22 "wasm",

23 "emulator",

24 "homebrew",

25 "retro",

26 "nes",

27 "snes",

28 "game-boy",

29 "genesis",

30 "atari",

31 "commodore-64",

32 "pc-engine",

33 "msx",

src/host/LibretroHost.jsView file

Lines 323-363javascript

323

324 async loadCore(jsPath, wasmPath, opts = {}) {

325 if (this.mod) throw new Error("core already loaded; create a new host");

326

327 // Proxied (multi-threaded) cores — e.g. PPSSPP/PSP — run on a dedicated "app thread" so the

328 // JS main thread never blocks while the core's worker threads proxy back to it (which would

329 // deadlock the synchronous frame-stepping). They own the ENTIRE GL stack on the app thread

src/platforms/gba/lib/libgba/crtend.oView file

•path = [redacted].o kind = native_binary sizeBytes = 1040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/platforms/gba/lib/libgba/crtend.oView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/install/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/install/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/host/LibretroHost.jsView file

343// GL deps lazily (clear install hint if absent). L344: const { LibretroGL } = await import("./LibretroGL.js"); L345: const { loadWebGl2Context } = await import("./glOptionalDep.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/host/LibretroHost.jsView on unpkg · L343

src/platforms/gba/lib/libgba/crtend.oView file

•path = [redacted].o kind = native_binary sizeBytes = 1040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/platforms/gba/lib/libgba/crtend.oView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg

Findings

1 High8 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/host/LibretroHost.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarysrc/platforms/gba/lib/libgba/crtend.o

MediumShips Wasm Modulesrc/analysis/wasm/rizin.wasm

MediumShips Build Helpersrc/platforms/snes/lib/pvsneslib/source/Makefile

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

2 "name": "romdevtools",

3 "version": "0.91.0",

5 "type": "module",

6 "main": "src/mcp/server.js",

7 "bin": {

8 "romdevtools": "src/mcp/server.js",

9 "romdev-mcp": "src/mcp/server.js",

10 "romdevtools-cli": "src/cli/smoke.js"

11 },

12 "scripts": {

13 "postinstall": "node src/install/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "smoke": "node --enable-source-maps src/cli/smoke.js",

15 "mcp": "node --enable-source-maps src/mcp/server.js",

16 "test": "node --test 'src/**/*.test.js' 'test/**/*.test.js'"

17 },

18 "keywords": [

19 "mcp",

20 "model-context-protocol",

21 "libretro",

22 "wasm",

23 "emulator",

24 "homebrew",

25 "retro",

26 "nes",

27 "snes",

28 "game-boy",

29 "genesis",

30 "atari",

31 "commodore-64",

32 "pc-engine",

33 "msx",

src/host/LibretroHost.jsView file

Lines 323-363javascript

323

324 async loadCore(jsPath, wasmPath, opts = {}) {

325 if (this.mod) throw new Error("core already loaded; create a new host");

326

327 // Proxied (multi-threaded) cores — e.g. PPSSPP/PSP — run on a dedicated "app thread" so the

328 // JS main thread never blocks while the core's worker threads proxy back to it (which would

329 // deadlock the synchronous frame-stepping). They own the ENTIRE GL stack on the app thread

src/platforms/gba/lib/libgba/crtend.oView file

•path = [redacted].o kind = native_binary sizeBytes = 1040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/platforms/gba/lib/libgba/crtend.oView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg