registry / wowdump / 0.4.0

wowdump@0.4.0

⚠ Under review

WoW native memory engine CLI with streaming section dumps, IDA/iced-x86 analysis and build-scoped profiles

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 223 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 8-48json

8 "url": "git+https://github.com/Follen/wowdump.git"

9 },

10 "files": [

11 "dist",

12 "skills",

13 "README.md",

14 "LICENSE"

15 ],

16 "type": "module",

17 "bin": {

18 "wowdump": "dist/cli.js"

19 },

20 "engines": {

21 "node": ">=22"

22 },

23 "scripts": {

24 "clean": "node scripts/clean-dist.mjs",

25 "build": "npm run clean && npm run build:host",

26 "build:host": "tsc -p tsconfig.json",

27 "wowdump": "node dist/cli.js",

28 "postinstall": "node -e \"const fs=require('node:fs');if(fs.existsSync('dist/skill.js'))import('./dist/skill.js').then(m=>m.installSkill()).catch(e=>console.error('wowdump: skill install skipped:',e.message))\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L28

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

29 "prepack": "npm run build",

30 "package:verify": "node scripts/verify-package.mjs",

31 "release:verify": "node scripts/verify-release-workflow.mjs verify",

32 "test": "npm run build:host && node --test --experimental-test-isolation=none tests/*.test.mjs",

33 "typecheck": "tsc --noEmit -p tsconfig.json"

34 },

35 "dependencies": {

36 "commander": "^13.1.0",

37 "iced-x86": "^1.21.0",

38 "koffi": "^2.16.3",

39 "zod": "^3.24.2"

40 },

41 "devDependencies": {

42 "@types/node": "^22.13.4",

43 "typescript": "^5.7.3"

44 },

45 "allowScripts": {

46 "koffi@2.16.3": true,

47 "wowdump@0.4.0": true

48 }

dist/core/profile-engine.jsView file

Lines 312-352javascript

312 else

313 value = value && typeof value === "object" ? value[String(step)] : undefined;

314 if (value ===

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('node:fs');if(fs.existsSync('dist/skill.js'))import('./dist/skill.js').then(m=>m.installSkill()).catch(e=>console.error('wowdump: skill install skipped:',...

wowdump@0.4.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code