Loading npm security reports…
WhatsApp API Modification
Importing the package contacts an author-controlled GitHub JSON URL and logs a message. The install hook only enforces Node.js 20+. No payload execution, credential harvesting, or persistence was confirmed.
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Package source references weak cryptographic algorithms.
lib/Utils/validate-connection.jsView on unpkg · L107Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg · L30Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L41Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Package source references weak cryptographic algorithms.
lib/Utils/validate-connection.jsView on unpkg · L107