classic-text-adventure

This module is primarily a game engine, but it contains a major supply-chain security risk: resume() unpickles (after zlib decompression) bytes loaded from an external save source using pickle.loads without integrity verification. If attackers can provide or tamper with save files, this can lead to arbitrary code execution. Other issues (user-controlled file paths and dynamic getattr dispatch) are secondary and context-dependent, but the pickle-based unsafe restore is sufficient for a high security warning.

This fragment is suspicious due to two core behaviors: it mutates the caller’s global namespace via inspect.stack() and it executes game.do_command as a side effect of __repr__ (implicit stringification). While there is no explicit malware or exfiltration code in the shown fragment, the design can enable indirect execution of powerful actions whenever the injected objects are printed/logged/inspected. Actual maliciousness depends on what game.do_command does, which is outside this module.