registry / @badzz88/baileys / 5.0.0
@badzz88/baileys@5.0.0
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe flagged lifecycle hook is a Node version check, while the inspected message utility network behavior is caller-mediated or tied to message media. The cited source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installation runs the preinstall Node version check; utility network behavior runs only when called by the application.
Impact
No confirmed unauthorized mutation, credential exposure, or unrelated network activity was established.
Mechanism
The preinstall script checks the Node.js major version. Link preview delegates URL lookup to a supplied function, and media download operates on message media.
AI rationale
The flagged lifecycle hook is a Node version check, while the inspected message utility network behavior is caller-mediated or tied to message media. The cited source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to lib/index.js and defines no runtime dependency on its own package.
- The only preinstall hook checks the Node.js major version and exits on versions below 20.
- Link preview uses a caller-provided getUrlInfo function for extracted message URLs.
- Media download handles message media and retries after specified HTTP errors; no credential harvesting or unrelated exfiltration was identified in the inspected code.
Evidence against
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
GitDependencyWildcardDependency
Oversized source lightweight scan
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/messages.jsView file
•matchType = normalized_sha256
matchedPackage = my-auto-follow@1.0.3
matchedPath = lib/Utils/messages.js
matchedIdentity = npm:bXktYXV0by1mb2xsb3c:1.0.3
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritylib/Utils/messages.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @badzz88/baileys@5.0.0.
See all versions of @badzz88/baileys for other recorded verdicts.
- Review the evidence and your use of @badzz88/baileys@5.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.