js game(untrusted)