Loading npm security reports…

romdevtools@0.93.0: Suspicious npm security report (Warn) | LPM Firewall

registry / romdevtools / 0.93.0

romdevtools@0.93.0

Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator co

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 3.24 MB of source, external domains: github.com, lospec.com, www.pico-8.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-33json

2 "name": "romdevtools",

3 "version": "0.93.0",

4 "description": "Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator cores. Use over plain HTTP, as an Agent Skill, or as an MCP server.",

5 "type": "module",

6 "main": "src/mcp/server.js",

7 "bin": {

8 "romdevtools": "src/mcp/server.js",

9 "romdev-mcp": "src/mcp/server.js",

10 "romdevtools-cli": "src/cli/smoke.js"

11 },

12 "scripts": {

13 "postinstall": "node src/install/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "smoke": "node --enable-source-maps src/cli/smoke.js",

15 "mcp": "node --enable-source-maps src/mcp/server.js",

16 "test": "node --test 'src/**/*.test.js' 'test/**/*.test.js'"

17 },

18 "keywords": [

19 "mcp",

20 "model-context-protocol",

21 "libretro",

22 "wasm",

23 "emulator",

24 "homebrew",

25 "retro",

26 "nes",

27 "snes",

28 "game-boy",

29 "genesis",

30 "atari",

31 "commodore-64",

32 "pc-engine",

33 "msx",

src/host/LibretroHost.jsView file

Lines 324-364javascript

324

325 async loadCore(jsPath, wasmPath, opts = {}) {

326 if (this.mod) throw new Error("core already loaded; create a new host");

327

328 // Proxied (multi-threaded) cores — e.g. PPSSPP/PSP — run on a dedicated "app thread" so the

src/platforms/gba/lib/libgba/crtend.oView file

•path = [redacted].o kind = native_binary sizeBytes = 1040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/platforms/gba/lib/libgba/crtend.oView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg

src/toolchains/_worker/pool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = romdevtools@0.91.0 matchedIdentity = npm:cm9tZGV2dG9vbHM:0.91.0 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/toolchains/_worker/pool.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

Source & flagged code

7 flagged

package.jsonView file

Lines 1-33json

2 "name": "romdevtools",

3 "version": "0.93.0",

5 "type": "module",

6 "main": "src/mcp/server.js",

7 "bin": {

8 "romdevtools": "src/mcp/server.js",

9 "romdev-mcp": "src/mcp/server.js",

10 "romdevtools-cli": "src/cli/smoke.js"

11 },

12 "scripts": {

13 "postinstall": "node src/install/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "smoke": "node --enable-source-maps src/cli/smoke.js",

15 "mcp": "node --enable-source-maps src/mcp/server.js",

16 "test": "node --test 'src/**/*.test.js' 'test/**/*.test.js'"

17 },

18 "keywords": [

19 "mcp",

20 "model-context-protocol",

21 "libretro",

22 "wasm",

23 "emulator",

24 "homebrew",

25 "retro",

26 "nes",

27 "snes",

28 "game-boy",

29 "genesis",

30 "atari",

31 "commodore-64",

32 "pc-engine",

33 "msx",

src/host/LibretroHost.jsView file

Lines 324-364javascript

324

325 async loadCore(jsPath, wasmPath, opts = {}) {

326 if (this.mod) throw new Error("core already loaded; create a new host");

327

328 // Proxied (multi-threaded) cores — e.g. PPSSPP/PSP — run on a dedicated "app thread" so the

src/platforms/gba/lib/libgba/crtend.oView file

•path = [redacted].o kind = native_binary sizeBytes = 1040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/platforms/gba/lib/libgba/crtend.oView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg

src/toolchains/_worker/pool.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/toolchains/_worker/pool.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code