registry / @badzz88/baileys / 8.4.6
@badzz88/baileys@8.4.6
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found a Node version gate at preinstall and media-related runtime network and process operations. The flagged constant appears within protocol token data; inspected source did not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installation triggers the Node version check; runtime media helpers are invoked by package consumers.
Impact
No confirmed malicious effect or credential exposure was established.
Mechanism
The helper exits when Node is older than version 20. Media code fetches media from supplied URLs, uploads media, and invokes a child process for thumbnail extraction.
AI rationale
Source inspection found a Node version gate at preinstall and media-related runtime network and process operations. The flagged constant appears within protocol token data; inspected source did not establish malicious behavior.
Evidence
engine-requirements.js
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The preinstall hook only runs engine-requirements.js, which checks the Node version and exits on versions below 20.
- The flagged API-like string is embedded among WhatsApp binary protocol token constants.
- Business helpers import media and filesystem utilities as part of product and image processing.
- Media fetches use supplied URLs and request options; the upload code sends media in a POST request.
Evidence against
- No inspected source showed credential collection, an unrelated recipient, or an exfiltration path.
- The inspected preinstall helper performs a Node version check rather than project mutation or network activity.
- The child-process call is inside a video-thumbnail extraction helper.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @badzz88/baileys@8.4.6.
See all versions of @badzz88/baileys for other recorded verdicts.
- Review the evidence and your use of @badzz88/baileys@8.4.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.