@badzz88/baileys@8.4.9: Malicious npm security report (Block)

Loading npm security reports…

Source & flagged code

6 flagged

package.jsonView file

Lines 15-55json

15 ],

16 "homepage": "https://github.com/Badzz88/baileys",

17 "repository": {

18 "url": "git+https://github.com/Badzz88/baileys.git"

19 },

20 "license": "MIT",

21 "author": "Badzz88",

22 "main": "src/index.js",

23 "files": [

24 "src/**/*",

25 "WAProto/**/*",

26 "engine-requirements.js",

27 "documentation/**/*"

28 ],

29 "scripts": {

30 "ncu": "npm-check-updates",

31 "format": "prettier --write \"src/**/*.{js,json,md}\"",

32 "lint": "tsc && eslint src --ext .js",

33 "lint:fix": "npm run format && npm run lint -- --fix",

34 "test": "jest --runInBand",

35 "preinstall": "node ./engine-requirements.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 },

37 "dependencies": {

38 "@adiwajshing/keyed-db": "^0.2.4",

39 "@cacheable/node-cache": "^3.0.1",

40 "@hapi/boom": "^10.0.1",

41 "async-mutex": "^0.5.0",

42 "cache-manager": "^7.2.8",

43 "libphonenumber-js": "^1.13.3",

44 "lru-cache": "^11.5.0",

45 "music-metadata": "^11.12.3",

46 "p-queue": "^9.3.0",

47 "pino": "^10.3.1",

48 "chalk": "^4.1.2",

49 "protobufjs": "^7.6.1",

50 "qrcode-terminal": "^0.12.0",

51 "whatsapp-rust-bridge-baron": "github:7ucg/whatsapp-rust-bridge",

52 "ws": "^8.21.0"

53 },

54 "devDependencies": {

55 "@eslint/eslintrc": "^3.3.1",

src/WABinary/constants.jsView file

Lines 584-624javascript

584 '044',

585 'mms_cat_v1_forward_hot_override_enabled',

586 'user_notice',

587 'ptt_waveform_send',

588 '047',

589 'Asia/Calcutta',

590

WAProto/fix-import.jsView file

Lines 1-21javascript

1const { readFileSync, writeFileSync } = require('fs');

2const { exit } = require('process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

WAProto/fix-import.jsView on unpkg · L1

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12844070 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/WABinary/constants.jsView file

604patternName = google_api_key severity = high line = 604 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

src/WABinary/constants.jsView on unpkg · L604

604patternName = google_api_key severity = high line = 604 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in src/WABinary/constants.js

src/WABinary/constants.jsView on unpkg · L604

@badzz88/baileys@8.4.9: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 15-55json

15 ],

16 "homepage": "https://github.com/Badzz88/baileys",

17 "repository": {

18 "url": "git+https://github.com/Badzz88/baileys.git"

19 },

20 "license": "MIT",

21 "author": "Badzz88",

22 "main": "src/index.js",

23 "files": [

24 "src/**/*",

25 "WAProto/**/*",

26 "engine-requirements.js",

27 "documentation/**/*"

28 ],

29 "scripts": {

30 "ncu": "npm-check-updates",

31 "format": "prettier --write \"src/**/*.{js,json,md}\"",

32 "lint": "tsc && eslint src --ext .js",

33 "lint:fix": "npm run format && npm run lint -- --fix",

34 "test": "jest --runInBand",

35 "preinstall": "node ./engine-requirements.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 },

37 "dependencies": {

38 "@adiwajshing/keyed-db": "^0.2.4",

39 "@cacheable/node-cache": "^3.0.1",

40 "@hapi/boom": "^10.0.1",

41 "async-mutex": "^0.5.0",

42 "cache-manager": "^7.2.8",

43 "libphonenumber-js": "^1.13.3",

44 "lru-cache": "^11.5.0",

45 "music-metadata": "^11.12.3",

46 "p-queue": "^9.3.0",

47 "pino": "^10.3.1",

48 "chalk": "^4.1.2",

49 "protobufjs": "^7.6.1",

50 "qrcode-terminal": "^0.12.0",

51 "whatsapp-rust-bridge-baron": "github:7ucg/whatsapp-rust-bridge",

52 "ws": "^8.21.0"

53 },

54 "devDependencies": {

55 "@eslint/eslintrc": "^3.3.1",

src/WABinary/constants.jsView file

Lines 584-624javascript

584 '044',

585 'mms_cat_v1_forward_hot_override_enabled',

586 'user_notice',

587 'ptt_waveform_send',

588 '047',

589 'Asia/Calcutta',

590

WAProto/fix-import.jsView file

Lines 1-21javascript

1const { readFileSync, writeFileSync } = require('fs');

2const { exit } = require('process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

WAProto/fix-import.jsView on unpkg · L1

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12844070 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

@badzz88/baileys@8.4.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code