registry / rpg2android / 1.0.0

rpg2android@1.0.0

RPG Maker MV/MZ → Android APK, iOS, Desktop, Web — native builds without emulators

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 372 KB of source, external domains: 7-zip.org, cdn.jsdelivr.net, dl.nwjs.io, files.catbox.moe, itch.io, schemas.android.com, username.github.io, www.apple.com, www.w3.org

Source & flagged code

6 flagged

dist/optimize/optimizer.jsView file

Lines 1-64javascript

1import path from "node:path";

2import fs from "node:fs";

3import os from "node:os";

4import { spawnSync, spawn } from "node:child_process";

5import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

dist/optimize/optimizer.jsView on unpkg · L3

6import sharp from "sharp";

7// ── cwebp detection ──

8let _cwebpPath = null;

9let _cwebpAvailable = null;

10function getCwebpPath() {

11 if (_cwebpPath !== null)

12 return _cwebpPath;

13 try {

14 const _require = createRequire(import.meta.url);

15 _cwebpPath = _require("cwebp-bin");

16 }

17 catch {

18 _cwebpPath = null;

19 }

20 return _cwebpPath;

21}

22function isCwebpAvailable() {

23 if (_cwebpAvailable !== null)

24 return _cwebpAvailable;

25 const binPath = getCwebpPath();

26 if (!binPath) {

27 _cwebpAvailable = false;

28 return false;

29 }

30 try {

31 const r = spawnSync(binPath, ["-version"], { timeout: 5000, stdio: "pipe" });

32 _cwebpAvailable = r.status === 0;

33 }

34 catch {

35 _cwebpAvailable = false;

36 }

37 return _cwebpAvailable;

38}

39function tryInstallCwebp() {

40 console.log(" 🔧 Устанавливаю cwebp через npm...");

41 try {

42 const r = spawnSync("npm", ["install", "cwebp-bin", "--no-save"], {

43 timeout: 60_000,

44 stdio: "pipe",

45 shell: true,

46 });

High

Shell

Package source references shell execution.

dist/optimize/optimizer.jsView on unpkg · L44

47 if (r.status === 0) {

48 // Сбрасываем кэш, чтобы getCwebpPath перепроверил

49 _cwebpPath = null;

50 _cwebpAvailable = null;

51 if (isCwebpAvailable()) {

52 console.log(" ✅ cwebp установлен");

53 return true;

54 }

55 }

56 console.log(" ⚠️ Установка cwebp не удалась, переключаюсь на sharp");

57 return false;

58 }

59 catch {

60 console.log(" ⚠️ Установка cwebp не удалась, переключаюсь на sharp");

61 return false;

62 }

63}

64function resolveBackend(preferred) {

dist/rgss/index.jsView file

Lines 210-250javascript

210 new_viewport: (...args) => {

211 if (args.length <= 1 && typeof args[0] === "object")

dist/index.jsView file

Lines 554-585javascript

554 process.exit(1);

555 }

556});

557// ---- Запуск с i18n init (hook выполняется после parse) ----

558program.hook("preAction", (thisCmd) => {

559 const opts

dist/rtp/extractor.jsView file

Lines 1-28javascript

1/**

2 * RTP Extractor — извлечение RTP-архивов.

3 *

4 * Все RTP теперь хранятся на catbox.moe в виде чистых .zip архивов.

5 * Внутри zip-архива может быть папка верхнего уровня (RPGVXAce/, RPGVX/, Standard/),

6 * которую _findRtpDir находит рекурсивным поиском.

7 *

8 * ## Формат

9 * - .zip: извлекается через unzip / powershell / 7z (fallback)

10 * → на выходе папка с Graphics/, Audio/, Fonts/

dist/build/capacitor.jsView file

Lines 727-767javascript

727/**

728 * Собирает Capacitor-проект для Android (APK/AAB) или iOS (Xcode-проект).

729 */

730export function buildCapacitorProject(capacitorDir, config) {

731 const isWindows = process.platform ===

Source & flagged code

6 flagged · loading source

dist/optimize/optimizer.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code