@bellaxchan/techxatz
A WebSockets library for interacting with WhatsApp Web
This report shows the evidence for @bellaxchan/techxatz@0.1.2, the only known version.
OpenSSF/OSV Malicious Advisory
imported 51m ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18674 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package is suspicious because ordinary socket creation schedules repeated newsletter FOLLOW requests without an explicit user request. The requests use an empty newsletter ID, so the source does not establish a successful action against a publisher-chosen target.
Independent scan evidence
public snapshot- Creating the newsletter socket schedules three FOLLOW queries with an empty newsletter ID, without requiring a newsletter API call.
- The normal socket factory chain creates the newsletter socket when the package’s message socket is made.
- The attempted FOLLOW requests contain no newsletter target, so the source does not establish that they follow a publisher-chosen account.
- The package is a WhatsApp WebSocket library, and its install hook only checks the Node.js version.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Package source references weak cryptographic algorithms.
lib/Utils/validate-connection.jsView on unpkg · L107Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/Utils/business.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages-media.jsView on unpkgFindings
Affected versions and remediation
This report applies to @bellaxchan/techxatz@0.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @bellaxchan/techxatz@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.