@chatunity/baileys@3.0.11: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@chatunity/baileys@3.0.11: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

lib/Utils/validate-connection.jsView file

117pull: false, L118: devicePairingData: { L119: buildHash: appVersionBuf, ... L147: L148: let hmacPrefix = Buffer.from([]) L149: if (accountType !== undefined && accountType === WAProto_1.proto.ADVEncryptionType.HOSTED) { ... L177: ]) L178: account.deviceSignature = crypto_2.Curve.sign(signedIdentityKey.private, deviceMsg) L179: const identity = signal_1.createSignalIdentity(lid, accountSignatureKey)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L117

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 304 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 10023457 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/ConnectionManager/PluginSystem.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/ConnectionManager/PluginSystem.js#virtual:normalized:round1View on unpkg

lib/Utils/messages-media.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @chatunity/baileys@3.0.3 matchedIdentity = npm:QGNoYXR1bml0eS9iYWlsZXlz:3.0.3 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Source & flagged code

9 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

lib/Utils/validate-connection.jsView file

117pull: false, L118: devicePairingData: { L119: buildHash: appVersionBuf, ... L147: L148: let hmacPrefix = Buffer.from([]) L149: if (accountType !== undefined && accountType === WAProto_1.proto.ADVEncryptionType.HOSTED) { ... L177: ]) L178: account.deviceSignature = crypto_2.Curve.sign(signedIdentityKey.private, deviceMsg) L179: const identity = signal_1.createSignalIdentity(lid, accountSignatureKey)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L117

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 304 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 10023457 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/ConnectionManager/PluginSystem.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/ConnectionManager/PluginSystem.js#virtual:normalized:round1View on unpkg

lib/Utils/messages-media.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @chatunity/baileys@3.0.3 matchedIdentity = npm:QGNoYXR1bml0eS9iYWlsZXlz:3.0.3 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20