registry / @badzz88/baileys / 7.0.0
@badzz88/baileys@7.0.0
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe default newsletter metadata is an unexplained alteration to media messages and warrants a warning. The inspected lifecycle hook is a Node version check, and the source excerpts do not establish a concrete attack warranting publication block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes media preparation with a message that has no annotations.
Impact
Outgoing media metadata may be attributed to or associated with that newsletter.
Mechanism
The helper inserts polygon vertices and newsletter metadata, including a fixed newsletter identifier, into the generated upload data.
AI rationale
The default newsletter metadata is an unexplained alteration to media messages and warrants a warning. The inspected lifecycle hook is a Node version check, and the source excerpts do not establish a concrete attack warranting publication block.
Evidence
lib/Utils/messages.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When media annotations are absent, `prepareWAMessageMedia` adds default newsletter metadata for `120363420249672073@newsletter`.
- The preinstall hook only runs a Node version check, and `prepare` is empty.
- The flagged utility also contains ordinary message normalization and link preview helpers.
Evidence against
- No credential collection or unrelated data transmission was identified in the inspected message utility excerpts.
- The media thumbnail shell call is used for video thumbnail generation and removes its temporary image afterward.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
GitDependency
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/messages.jsView file
•matchType = normalized_sha256
matchedPackage = my-auto-follow@1.0.3
matchedPath = lib/Utils/messages.js
matchedIdentity = npm:bXktYXV0by1mb2xsb3c:1.0.3
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritylib/Utils/messages.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumAi Review Evidencelib/Utils/messages.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @badzz88/baileys@7.0.0.
See all versions of @badzz88/baileys for other recorded verdicts.
- Review the evidence and your use of @badzz88/baileys@7.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.