@badzz88/baileys@8.4.7
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 14d ago · by lpm-firewall-aiStatic source inspection found a concrete shell command-injection risk in video thumbnail generation. The install hook and the other reviewed flagged code do not establish malicious package behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes video thumbnail generation with a path controlled by untrusted input.
Impact
Shell metacharacters in the supplied path may execute unintended commands with the package process's privileges.
Mechanism
The helper builds an ffmpeg command by interpolating path values and executes it through child_process.exec.
AI rationale
Static source inspection found a concrete shell command-injection risk in video thumbnail generation. The install hook and the other reviewed flagged code do not establish malicious package behavior.
Evidence
lib/Utils/messages-media.js
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The exported thumbnail helper passes its file argument into a shell command without escaping it, creating a command-injection risk when callers supply an attacker-controlled path.
- The video thumbnail path calls that helper with its supplied file argument.
- The preinstall hook only checks the Node.js version; no malicious install behavior was identified.
- The flagged network code fetches caller-supplied URLs and uploads media through a WhatsApp media upload helper.
- The flagged constant is one entry in a binary protocol token table.
- The business helper uploads product images through a supplied WhatsApp upload callback.
Evidence against
- The package manifest has empty prepare and prepack hooks, and its preinstall script invokes a Node-version requirement check.
- The inspected network and media paths align with WhatsApp media handling; no credential harvesting or unrelated exfiltration was identified.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
5 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @badzz88/baileys@8.4.7.
See all versions of @badzz88/baileys for other recorded verdicts.
- Review the evidence and your use of @badzz88/baileys@8.4.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.