@astracode/byles-new: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@astracode/byles-new: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•dependencies changed=libsignal

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/crypto.jsView file

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto'; L2: /* @ts-ignore */ ... L12: return { L13: private: Buffer.from(privKey), L14: // remove version byte

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 137 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8236422 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Source & flagged code

9 flagged

package.jsonView file

Lines 5-46json

5 "description": "Modifikasi Library Baileys V6.7× by AstraCode",

6 "keywords": [

7 "whatsapp",

8 "automation",

9 "whatsapp-bot",

10 "whatsapp-app"

11 ],

12 "homepage": "https://github.com/Astra-Devl/byles-new/",

13 "repository": {

14 "url": "git@github.com:Astra-Devl/byles-new.git"

15 },

16 "license": "MIT",

17 "author": "AstraCode",

18 "main": "lib/index.js",

19 "types": "lib/index.d.ts",

20 "files": [

21 "lib/**/*",

22 "WAProto/**/*",

23 "engine-requirements.js"

24 ],

25 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L25

26 "preinstall": "node ./engine-requirements.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "@cacheable/node-cache": "^1.4.0",

30 "@hapi/boom": "^9.1.3",

31 "async-mutex": "^0.5.0",

32 "axios": "^1.6.0",

33 "libsignal": "git+https://github.com/whiskeysockets/libsignal-node",

34 "music-metadata": "^11.7.0",

35 "pino": "^9.6",

36 "protobufjs": "^7.2.4",

37 "ws": "^8.13.0"

38 },

39 "devDependencies": {

40 "@eslint/eslintrc": "^3.3.1",

41 "@eslint/js": "^9.31.0",

42 "@types/jest": "^30.0.0",

43 "@types/node": "^16.0.0",

44 "@types/ws": "^8.0.0",

45 "@typescript-eslint/eslint-plugin": "^8.32.0",

46 "@typescript-eslint/parser": "^8.32.0",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/crypto.jsView file

Lines 1-21javascript

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';

2/* @ts-ignore */

3import * as libsignal from 'libsignal';

4import { KEY_BUNDLE_TYPE } from '../Defaults/index.js';

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 137 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8236422 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: