wowdump@2.1.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

wowdump@2.1.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

32"scripts": { "build": "npm run build:native", "build:native": "node scripts/build-native.mjs", "wowdump": "node bin/wowdump.mjs", "postinstall": "node bin/postinstall.mjs", "pre

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

package.jsonView on unpkg · L32

bin/script-host.mjsView file

109if (init.expectedNodeVersion && init.expectedNodeVersion !== process.versions.node) throw Object.assign(new Error('Node version differs from recording'), { code: 'SCRIPT_RUNTIME_CH... L110: const script = await import(pathToFileURL(init.entry).href); L111: if (script.requires !== undefined && (!Array.isArray(script.requires) || script.requires.some(name => typeof ctx[name] !== 'function'))) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/script-host.mjsView on unpkg · L109

bin/wowdump.exeView file

•path = bin/wowdump.exe kind = native_binary sizeBytes = 16226304 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/wowdump.exeView on unpkg

bin/postinstall.mjsView file

5const root = join(dirname(fileURLToPath(import.meta.url)), '..'); const binary = join(root, 'bin', 'wowdump.exe'); // Source checkouts can install development dependencies before their first build. if (existsSync(binary) && process.env.WOWDUMP_SKIP_SKILL_INSTALL !== '1') { const result = spawnSync(binary, ['skill', 'install', '--json'], { encoding: 'utf8', windowsHide: true, env: { ...process.env, WOW

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

bin/postinstall.mjsView on unpkg · L5

skills/wowdump/SKILL.mdView file

1--- name: wowdump description: 用 wowdump 只读调查 WoW 内存、RVA、结构布局和 Lua/native 关联，保存 EXE/DLL 与配方，或将配方迁移到指定游戏 build。支持静态分析、录制回放和恢复调查；普通游戏玩法问题不使用本 Skill。 --- # wowdump

Medium

Ai Review Evidence

The package ships a first-party wowdump skill, indicating the install action is agent extension setup.

skills/wowdump/SKILL.mdView on unpkg · L1

bin/wowdump.mjsView file

7const root = resolve(dirname(fileURLToPath(import.meta.url)), '..'); const executable = process.env.WOWDUMP_BINARY || join(root, 'bin', process.platform === 'win32' ? 'wowdump.exe' : 'wowdump'); if (!existsSync(executable)) { process.stderr.write(JSON.stringify({ ok: false, error: { code: 'BINARY_MISSING', message: `The native wowdump executable is missing: ${executable}`, nextStep: 'Reinstall the published npm package, or run npm run build:native in the source checkout.' } }) + '\n'); p

Medium

Ai Review Evidence

The executable wrapper runs the bundled native binary, but its installation destination and write behavior are not visible in the inspected source.

bin/wowdump.mjsView on unpkg · L7

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

32"scripts": { "build": "npm run build:native", "build:native": "node scripts/build-native.mjs", "wowdump": "node bin/wowdump.mjs", "postinstall": "node bin/postinstall.mjs", "pre

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

package.jsonView on unpkg · L32

bin/script-host.mjsView file

109if (init.expectedNodeVersion && init.expectedNodeVersion !== process.versions.node) throw Object.assign(new Error('Node version differs from recording'), { code: 'SCRIPT_RUNTIME_CH... L110: const script = await import(pathToFileURL(init.entry).href); L111: if (script.requires !== undefined && (!Array.isArray(script.requires) || script.requires.some(name => typeof ctx[name] !== 'function'))) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/script-host.mjsView on unpkg · L109

bin/wowdump.exeView file

•path = bin/wowdump.exe kind = native_binary sizeBytes = 16226304 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/wowdump.exeView on unpkg

bin/postinstall.mjsView file

5const root = join(dirname(fileURLToPath(import.meta.url)), '..'); const binary = join(root, 'bin', 'wowdump.exe'); // Source checkouts can install development dependencies before their first build. if (existsSync(binary) && process.env.WOWDUMP_SKIP_SKILL_INSTALL !== '1') { const result = spawnSync(binary, ['skill', 'install', '--json'], { encoding: 'utf8', windowsHide: true, env: { ...process.env, WOW

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall hook that invokes the bundled executable with a skill installation command unless an environment flag disables it.

bin/postinstall.mjsView on unpkg · L5

skills/wowdump/SKILL.mdView file

Lines 1-21markdown

1---

2name: wowdump

3description: 用 wowdump 只读调查 WoW 内存、RVA、结构布局和 Lua/native 关联，保存 EXE/DLL 与配方，或将配方迁移到指定游戏 build。支持静态分析、录制回放和恢复调查；普通游戏玩法问题不使用本 Skill。

4---

5

6# wowdump

7

Medium

Ai Review Evidence

The package ships a first-party wowdump skill, indicating the install action is agent extension setup.

skills/wowdump/SKILL.mdView on unpkg · L1

8CLI 负责读取、输入身份、归档和恢复；Agent 负责调查方向、结构推理和证据判断。普通读取无需先建配方。只读取目标进程，不注入、写入、冻结或调用游戏函数；现场读取支持 Windows x64。

bin/wowdump.mjsView file

7const root = resolve(dirname(fileURLToPath(import.meta.url)), '..'); const executable = process.env.WOWDUMP_BINARY || join(root, 'bin', process.platform === 'win32' ? 'wowdump.exe' : 'wowdump'); if (!existsSync(executable)) { process.stderr.write(JSON.stringify({ ok: false, error: { code: 'BINARY_MISSING', message: `The native wowdump executable is missing: ${executable}`, nextStep: 'Reinstall the published npm package, or run npm run build:native in the source checkout.' } }) + '\n'); p

Medium

Ai Review Evidence

The executable wrapper runs the bundled native binary, but its installation destination and write behavior are not visible in the inspected source.

bin/wowdump.mjsView on unpkg · L7