@celestial-community/baileys
WhatsApp API Modification
This report shows the evidence for @celestial-community/baileys@1.0.0. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe source establishes automatic, remotely directed account manipulation through the active socket, beyond ordinary user-invoked newsletter functionality. This concrete behavior supports blocking even without evidence of secret theft.
Decision evidence
public snapshot- The active newsletter socket fetches a base64-hidden remote channel list automatically when the connection opens.
- Remote list entries are submitted as channel follow requests without a consent flag or explicit user command.
- The message socket constructs the newsletter socket, making the automatic behavior reachable through normal socket creation.
- The declared main entrypoint exports the WhatsApp socket used by this construction chain.
- The preinstall script only checks the Node.js version.
- The inspected follow behavior does not establish credential theft or remote code execution.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
lib/index.jsView on unpkg · L6Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/Socket/newsletter.jsView on unpkg · L23A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to @celestial-community/baileys@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @celestial-community/baileys@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.