wowdump: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

wowdump: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

32"scripts": { "build": "npm run build:native", "build:native": "node scripts/build-native.mjs", "wowdump": "node bin/wowdump.mjs", "postinstall": "node bin/postinstall.mjs", "pre

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

package.jsonView on unpkg · L32

bin/script-host.mjsView file

109if (init.expectedNodeVersion && init.expectedNodeVersion !== process.versions.node) throw Object.assign(new Error('Node version differs from recording'), { code: 'SCRIPT_RUNTIME_CH... L110: const script = await import(pathToFileURL(init.entry).href); L111: if (script.requires !== undefined && (!Array.isArray(script.requires) || script.requires.some(name => typeof ctx[name] !== 'function'))) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/script-host.mjsView on unpkg · L109

bin/wowdump.exeView file

•path = bin/wowdump.exe kind = native_binary sizeBytes = 16226304 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/wowdump.exeView on unpkg

bin/postinstall.mjsView file

5const root = join(dirname(fileURLToPath(import.meta.url)), '..'); const binary = join(root, 'bin', 'wowdump.exe'); // Source checkouts can install development dependencies before their first build. if (existsSync(binary) && process.env.WOWDUMP_SKIP_SKILL_INSTALL !== '1') { const result = spawnSync(binary, ['skill', 'install', '--json'], { encoding: 'utf8', windowsHide: true, env: { ...process.env, WOW

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

bin/postinstall.mjsView on unpkg · L5

skills/wowdump/SKILL.mdView file

1--- name: wowdump description: 用 wowdump 只读调查 WoW 内存、RVA、结构布局和 Lua/native 关联，保存 EXE/DLL 与配方，或将配方迁移到指定游戏 build。支持静态分析、录制回放和恢复调查；普通游戏玩法问题不使用本 Skill。 --- # wowdump

Medium

Ai Review Evidence

The package ships a first-party wowdump skill, indicating the install action is agent extension setup.

skills/wowdump/SKILL.mdView on unpkg · L1

bin/wowdump.mjsView file

7const root = resolve(dirname(fileURLToPath(import.meta.url)), '..'); const executable = process.env.WOWDUMP_BINARY || join(root, 'bin', process.platform === 'win32' ? 'wowdump.exe' : 'wowdump'); if (!existsSync(executable)) { process.stderr.write(JSON.stringify({ ok: false, error: { code: 'BINARY_MISSING', message: `The native wowdump executable is missing: ${executable}`, nextStep: 'Reinstall the published npm package, or run npm run build:native in the source checkout.' } }) + '\n'); p

Medium

Ai Review Evidence

The executable wrapper runs the bundled native binary, but its installation destination and write behavior are not visible in the inspected source.

bin/wowdump.mjsView on unpkg · L7

Source & flagged code

8 flagged

package.jsonView file

Lines 12-45json

12 "schemas",

13 "templates",

14 "skills/wowdump/SKILL.md",

15 "skills/wowdump/references/v2",

16 "README.md",

17 "LICENSE"

18 ],

19 "type": "module",

20 "bin": {

21 "wowdump": "bin/wowdump.mjs"

22 },

23 "engines": {

24 "node": ">=22"

25 },

26 "os": [

27 "win32"

28 ],

29 "cpu": [

30 "x64"

31 ],

32 "scripts": {

33 "build": "npm run build:native",

34 "build:native": "node scripts/build-native.mjs",

35 "wowdump": "node bin/wowdump.mjs",

36 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "prepack": "npm run build",

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

package.jsonView on unpkg · L32

38 "package:verify": "node scripts/verify-package.mjs",

39 "release:verify": "node scripts/verify-release-workflow.mjs verify",

40 "test": "cargo test --workspace --locked",

41 "typecheck": "cargo check --workspace --locked",

42 "lint": "cargo fmt --all --check && cargo clippy --workspace --all-targets --locked -- -D warnings"

43 }

44}

45

bin/script-host.mjsView file

Lines 89-129javascript

89 time: () => rpc('now'),

90 random: () => rpc('random'),

91 input: name => rpc(

bin/wowdump.exeView file

•path = bin/wowdump.exe kind = native_binary sizeBytes = 16226304 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/wowdump.exeView on unpkg

bin/postinstall.mjsView file

Lines 1-15javascript

1import { existsSync } from 'node:fs';

2import { dirname, join } from 'node:path';

3import { fileURLToPath } from 'node:url';

4import { spawnSync } from 'node:child_process';

skills/wowdump/SKILL.mdView file

Lines 1-21markdown

1---

2name: wowdump

3description: 用 wowdump 只读调查 WoW 内存、RVA、结构布局和 Lua/native 关联，保存 EXE/DLL 与配方，或将配方迁移到指定游戏 build。支持静态分析、录制回放和恢复调查；普通游戏玩法问题不使用本 Skill。

4---

5

6# wowdump

7

Medium

Ai Review Evidence

The package ships a first-party wowdump skill, indicating the install action is agent extension setup.

skills/wowdump/SKILL.mdView on unpkg · L1

8CLI 负责读取、输入身份、归档和恢复；Agent 负责调查方向、结构推理和证据判断。普通读取无需先建配方。只读取目标进程，不注入、写入、冻结或调用游戏函数；现场读取支持 Windows x64。

bin/wowdump.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { spawn } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { dirname, join, resolve } from 'node:path';

5import { fileURLToPath } from