registry / wowdump / 1.4.0

wowdump@1.4.0

⚠ Under review

World of Warcraft memory reading tool: read live process memory and versioned section files read-only, with streaming section dumps, profiles, build relocation and a machine-level recipe library

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 86.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 972 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 8-48json

8 "url": "git+https://github.com/Follen/wowdump.git"

9 },

10 "files": [

11 "dist",

12 "skills",

13 "README.md",

14 "LICENSE"

15 ],

16 "type": "module",

17 "bin": {

18 "wowdump": "dist/cli.js"

19 },

20 "engines": {

21 "node": ">=22"

22 },

23 "scripts": {

24 "clean": "node scripts/clean-dist.mjs",

25 "build": "npm run clean && npm run build:host",

26 "build:host": "tsc -p tsconfig.json",

27 "wowdump": "node dist/cli.js",

28 "postinstall": "node -e \"const fs=require('node:fs');if(fs.existsSync('dist/skill.js'))import('./dist/skill.js').then(m=>m.installSkill()).catch(e=>console.error('wowdump: skill install skipped:',e.message))\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L28

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

29 "prepack": "npm run build",

30 "package:verify": "node scripts/verify-package.mjs",

31 "release:verify": "node scripts/verify-release-workflow.mjs verify",

32 "test": "npm run build:host && node --test --experimental-test-isolation=none tests/*.test.mjs",

33 "typecheck": "tsc --noEmit -p tsconfig.json"

34 },

35 "dependencies": {

36 "commander": "^13.1.0",

37 "iced-x86": "^1.21.0",

38 "koffi": "^2.16.3",

39 "zod": "^3.24.2"

40 },

41 "devDependencies": {

42 "@types/node": "^22.13.4",

43 "typescript": "^5.7.3"

44 },

45 "allowScripts": {

46 "koffi@2.16.3": true

47 }

48}

dist/core/profile-engine.jsView file

Lines 456-496javascript

456 else

457 value = value && typeof value === "object" ? value[String(step)] : undefined;

458 if (value ===

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('node:fs');if(fs.existsSync('dist/skill.js'))import('./dist/skill.js').then(m=>m.installSkill()).catch(e=>console.error('wowdump: skill install skipped:',...

wowdump@1.4.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code