registry / romdevtools / 0.91.0

romdevtools@0.91.0

Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator co

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 3.20 MB of source, external domains: github.com, lospec.com, www.pico-8.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

2 "name": "romdevtools",

3 "version": "0.91.0",

4 "description": "Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator cores. Use over plain HTTP, as an Agent Skill, or as an MCP server.",

5 "type": "module",

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/install/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/install/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/host/LibretroHost.jsView file

343// GL deps lazily (clear install hint if absent). L344: const { LibretroGL } = await import("./LibretroGL.js"); L345: const { loadWebGl2Context } = await import("./glOptionalDep.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/host/LibretroHost.jsView on unpkg · L343

src/platforms/gba/lib/libgba/crtend.oView file

•path = [redacted].o kind = native_binary sizeBytes = 1040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/platforms/gba/lib/libgba/crtend.oView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg

Findings

1 High8 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/host/LibretroHost.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarysrc/platforms/gba/lib/libgba/crtend.o

MediumShips Wasm Modulesrc/analysis/wasm/rizin.wasm

MediumShips Build Helpersrc/platforms/snes/lib/pvsneslib/source/Makefile

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

src/host/LibretroHost.jsView file

Lines 323-363javascript

323

324 async loadCore(jsPath, wasmPath, opts = {}) {

325 if (this.mod) throw new Error("core already loaded; create a new host");

326

327 // Proxied (multi-threaded) cores — e.g. PPSSPP/PSP — run on a dedicated "app thread" so the

328 // JS main thread never blocks while the core's worker threads proxy back to it (which would

329 // deadlock the synchronous frame-stepping). They own the ENTIRE GL stack on the app thread

330 // (native-gles + webgl-node loaded + context created + readback all there). The registry

331 // marks them; the single-threaded GL cores keep the main-thread GL path below.

332 this._proxied = !!opts.proxied;

333 this.state.proxied = this._proxied;

334 // NODERAWFS cores (flycast): the WASM FS is Node's real fs, so the core fopens the

335 // disc image straight off disk — loadMedia must pass the REAL path and NOT slurp

336 // the (up to ~1GB) file into the WASM heap. See loadMedia.

337 this._noderawfs = !!opts.noderawfs;

338

339 let glCanvas = null;

340 if (opts.hwRender && !this._proxied) {

341 // Set up the HW-render path: LibretroGL owns the FBO/readback; a webgl-node

342 // mock canvas backs the minified core's GLctx. Both pull the OPTIONAL native

343 // GL deps lazily (clear install hint if absent).

344 const { LibretroGL } = await import("./LibretroGL.js");

345 const { loadWebGl2Context } = await import("./glOptionalDep.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/host/LibretroHost.jsView on unpkg · L343

346 this.hwRender = new LibretroGL();

347 await this.hwRender.ensureGl();

348 const createWebGL2Context = await loadWebGl2Context();

349 const { canvas } = createWebGL2Context(640, 480);

350 // Skip Emscripten's Safari WebGL2 workaround (breaks instanceof) by

351 // pre-setting the flag it checks.

352 canvas.getContextSafariWebGL2Fixed = canvas.getContext;

353 glCanvas = canvas;

354 this._glContextCreated = true;

355 // The env callback routes SET_HW_RENDER to this handler.

356 this.state.hwRender = this.hwRender;

357 }

358

359 const mod = await loadLibretroCore({ jsPath, wasmPath, glCanvas });

360 this.mod = mod;

361

362 // AUTO-DETECT NODERAWFS regardless of the caller's opt. A NODERAWFS build replaces

363 // the in-RAM MEMFS with Node's real fs, so `FS.writeFile("/rom.elf", …)` would target