@bellaxchan/eleventech@0.0.8
A WebSockets library for interacting with Customize WhatsApp.
AI Security Review
scanned 54m ago · by lpm-firewall-aiThe normal socket-construction path schedules a follow of a hard-coded WhatsApp newsletter using the user’s account. The action is unrelated to an explicit user request, so this is malicious account abuse.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller creates the package’s normal WhatsApp socket.
Impact
Uses the user’s WhatsApp account to follow a target selected by the package publisher without the user requesting that follow.
Mechanism
The socket construction chain reaches makeNewsletterSocket, which schedules a FOLLOW request after 10 seconds for the hard-coded newsletter ID encoded in the source.
Attack narrative
When the package’s regular socket client is created, its constructor chain creates the newsletter socket. That constructor schedules a WhatsApp FOLLOW request roughly 10 seconds later for a hard-coded newsletter ID, without requiring the caller to request a follow. This performs an account action toward a publisher-chosen target.
AI rationale
The normal socket-construction path schedules a follow of a hard-coded WhatsApp newsletter using the user’s account. The action is unrelated to an explicit user request, so this is malicious account abuse.
Evidence
lib/Socket/index.jslib/Socket/communities.jslib/Socket/business.jslib/Socket/messages-recv.jslib/Socket/messages-send.jslib/Socket/username.jslib/Socket/newsletter.js
Network endpoints1
web.whatsapp.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Creating the normal WhatsApp socket constructs the newsletter socket, which schedules a follow request for a hard-coded newsletter about 10 seconds later.
- The package’s preinstall script only checks the Node.js version and exits on versions below 20.
Evidence against
- The newsletter follow uses the package’s WhatsApp connection and a WhatsApp newsletter identifier; no unrelated collector is involved.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
WAProto/index.js11.6 MB file, sampled 256 KB
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
Affected versions and remediation
This report applies to @bellaxchan/eleventech@0.0.8.
See all versions of @bellaxchan/eleventech for other recorded verdicts.
- Avoid installing @bellaxchan/eleventech@0.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.