Yes. A Unity project can contain editor scripts that execute as soon as the project loads. Unity documents an attribute, InitializeOnLoad, whose static constructors run when Unity first loads your project and after scripts recompile. So a project or asset pack you did not write can run code before you press Play.
What Unity says about running code on load
Unity's scripting reference describes the InitializeOnLoad attribute as a way to initialize an Editor class when Unity loads and when your scripts are recompiled. Static constructors marked with it are called on a domain reload. Per the documentation, that happens when Unity first loads your project, when Unity detects script changes with Auto Refresh enabled, and when you enter Play mode with domain reload turned on.
That is a useful feature for tool authors. It is also the reason a downloaded sample project deserves the same care as a downloaded program. The code runs in the editor process, with the permissions of the person who opened the project.
Why this matters for a studio
Studios import code from many places: asset packs, sample scenes, a contractor's prototype, a plugin zip from a forum. Each one can include editor scripts. Unity's page does not describe this as a flaw, and it is not one. It is how the editor extends itself. The risk is simply that trust in the content is the only control.
This is the same shape of problem as build-time scripts in other ecosystems. If you want the wider picture for games, see the post on inventorying engine, middleware and asset packs.
A review routine before you open an unknown project
Do this in a throwaway environment, not on a build machine or a laptop with signing keys.
- Open the project folder in a text editor or IDE, not in Unity.
- Search the Assets and Packages folders for the attribute name InitializeOnLoad and for files inside any folder named Editor.
- Read each match. Look for network calls, process launches, file writes outside the project and anything that touches environment variables or credential files.
- Check Packages/manifest.json for Git URLs and unfamiliar registries. See how Unity chooses a registry.
- Look for precompiled libraries you cannot read. Those need a vendor answer, not a code review.
- Only then open it, ideally in a disposable virtual machine with no stored credentials.
Make it a team rule
Put the routine into your onboarding doc for any imported project. Make one person the reviewer for editor scripts in third-party content, and record the result next to the asset in your inventory: name, version, source, date reviewed, who reviewed it. If the pack updates, review the diff of the Editor folders again.
Automated scanning helps with the dependency side of this. It will not read your intent in a custom editor script, so keep the human review for code that runs in the editor.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates, and you can run a free scan at https://gold.safeguard.sh/scan. Package coverage depends on the ecosystems a project uses, so check how your engine's packages are represented before relying on any scan.
Quick check
Does Play mode have to be pressed for the code to run?
No. According to Unity's documentation, InitializeOnLoad static constructors are called when Unity first loads the project and after script recompiles, not only in Play mode.
Is every InitializeOnLoad script malicious?
No. Many legitimate tools use it. The point is that you should know which ones are in your project and who wrote them.
Sources
Last reviewed: 19 October 2026.
