registry / @badzz88/baileys / 8.4.2
@badzz88/baileys@8.4.2
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe lifecycle hook runs a Node.js compatibility check, while the inspected media and protocol code is consistent with a WhatsApp client library. The flagged helper is malformed and no reviewed source establishes an active attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation invokes the preinstall Node.js version check; media operations run when called by the application.
Impact
No malicious effect was established from the inspected behavior.
Mechanism
The install check reads the Node.js major version and exits for versions below 20. Media utilities handle caller-supplied media and upload through refreshed media connection details.
AI rationale
The lifecycle hook runs a Node.js compatibility check, while the inspected media and protocol code is consistent with a WhatsApp client library. The flagged helper is malformed and no reviewed source establishes an active attack.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The preinstall hook runs a Node.js version check; prepare and prepack are empty.
- The high-secret finding is in a protocol token table, with adjacent entries that are protocol strings and values.
- The flagged WAProto helper is malformed and its file rewrite is not referenced by the inspected lifecycle hook.
- The media utility processes supplied buffers and streams; its upload helper uses connection information returned by the WhatsApp media refresh function.
- The preinstall helper exits only when the Node.js major version is below 20.
Evidence against
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/fix-import.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
Affected versions and remediation
This report applies to @badzz88/baileys@8.4.2.
See all versions of @badzz88/baileys for other recorded verdicts.
- Review the evidence and your use of @badzz88/baileys@8.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.