phaser-playtest

No clear evidence of built-in malware (no overt credential theft, persistence, or external exfiltration) is present in this module. However, this harness is inherently high-risk if attackers can influence opts.project, opts.scenario, or scenario contents: it executes npm scripts from a chosen directory (Node-side command execution), dynamically imports a scenario module from a CLI path (Node-side arbitrary code execution), and evaluates scenario-provided expressions via string-based page.evaluate (eval-like execution in the browser). If used only with fully trusted projects/scenarios/URLs in controlled CI environments, risk is reduced; otherwise, treat it as executing untrusted code.