registry / @badzz88/baileys / 8.5.7

@badzz88/baileys@8.5.7

Baileys Whatsapp Api Modification By Badzz88

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 135 file(s), 2.33 MB of source, external domains: acs.whatsapp.com, api.telegram.org, call.whatsapp.com, graph.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js11.6 MB file, sampled 256 KB

ChildProcess

Source & flagged code

7 flagged

lib/WABinary/constants.jsView file

Lines 584-624javascript

584 '044',

585 'mms_cat_v1_forward_hot_override_enabled',

586 'user_notice',

587 'ptt_waveform_send',

588 '047',

589 'Asia/Calcutta',

590 '250',

591 'md_privacy_v2',

592 '31',

593 '29',

594 '128',

595 'md_messaging_enabled',

596 '046',

597 'crypto',

598 '690',

599 '045',

600 'enc_iv',

601 '75',

602 'failure',

603 'ptt_oot_playback',

604 'AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L604

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L604

605 'w',

606 '048',

607 '2201',

608 'web_large_files_ui',

609 'Asia/Makassar',

610 '812',

611 'status_collapse_muted',

612 '1334',

613 '257',

614 '2HP4dm',

615 '049',

616 'patches',

617 '1290',

618 '43cY6T',

619 'America/Caracas',

620 'web_sticker_maker',

621 'campaign',

622 'ptt_pausable_enabled',

623 '33',

624 '42',

lib/antiban.jsView file

Lines 1-21javascript

1const __importMetaUrl = require('url').pathToFileURL(__filename).href

2;('use strict')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/antiban.jsView on unpkg · L1

3var __create = Object.create

lib/Utils/crypto.jsView file

Lines 19-59javascript

19// Pure Node.js `crypto` / hand-written JS only -- no native/WASM module

20// dependency anywhere in this file (including `Curve`, X25519 key exchange +

21// XEdDSA signing). XEdDSA specifically is validated against the official

22// RFC 8032 Ed25519 test vectors, RFC 7748-style X25519 DH vectors, and

23// hundreds of randomized Montgomery<->Edwards interop + self-consistency

24// checks -- see ./curve25519-js.js for details and references.

26// ── MD5 ────────────────────────────────────────────────────────────────────────

27const md5 =

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145740 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @badzz88/baileys@8.5.6 matchedIdentity = npm:QGJhZHp6ODgvYmFpbGV5cw:8.5.6 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code