registry / romdevtools / 0.99.0

romdevtools@0.99.0

Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator co

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 172 file(s), 2.85 MB of source, external domains: github.com, lospec.com, www.pico-8.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

2 "name": "romdevtools",

3 "version": "0.99.0",

4 "description": "Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator cores. Use over plain HTTP, as an Agent Skill, or as an MCP server.",

5 "type": "module",

6 "main": "src/mcp/server.js",

7 "bin": {

8 "romdevtools": "src/mcp/server.js",

9 "romdev-mcp": "src/mcp/server.js",

10 "romdevtools-cli": "src/cli/smoke.js"

11 },

12 "scripts": {

13 "postinstall": "node src/install/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "smoke": "node --enable-source-maps src/cli/smoke.js",

15 "mcp": "node --enable-source-maps src/mcp/server.js",

16 "test": "node --test 'src/**/*.test.js' 'test/**/*.test.js'"

17 },

18 "keywords": [

19 "mcp",

20 "model-context-protocol",

21 "libretro",

22 "wasm",

23 "emulator",

24 "homebrew",

25 "retro",

26 "nes",

27 "snes",

28 "game-boy",

29 "genesis",

30 "atari",

31 "commodore-64",

32 "pc-engine",

33 "msx",

src/analysis/wasm/rizin.jsView file

Lines 16-56javascript

16// 3. pre-run appended it, var Module = {}; ..generated code..

17// 4. External script tag defines var Module.

18// We need to check if Module already exists (e.g. case 3 above).

19// Substitution will be replaced with actual code on later stage of the build,

20// this way Closure Compiler will not mangle it (e.g. case 4. above).

21// Note that if you want to run closure, and also to use Module

22// after the generated code, you will need to define var Module = {};

23// before the code. Then that object will be used in the code, and you

24// can continue to use Module afterwards as well.

src/toolchains/mips-c/lib/be/libm.aView file

•path = src/toolchains/mips-c/lib/be/libm.a kind = native_binary sizeBytes = 808656 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/toolchains/mips-c/lib/be/libm.aView on unpkg

src/analysis/wasm/rizin.wasmView file

•path = src/analysis/wasm/rizin.wasm kind = wasm_module sizeBytes = 30762096 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/analysis/wasm/rizin.wasmView on unpkg

src/platforms/snes/lib/pvsneslib/source/MakefileView file

•path = [redacted] kind = build_helper sizeBytes = 2332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/platforms/snes/lib/pvsneslib/source/MakefileView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code