registry / @chatunity/baileys / 3.0.3

@chatunity/baileys@3.0.3

whatsapp api multidevice by ChatUnity

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 123 file(s), 1.72 MB of source, external domains: catbox.moe, ezgif.com, github.com, mmg.whatsapp.net, qu.ax, scdn.pdi.moe, tmpfiles.org, uguu.se, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js9.56 MB file, sampled 256 KB

ChildProcessHighEntropyStrings

Source & flagged code

9 flagged

package.jsonView file

Lines 25-65json

25 "types": "lib/index.d.ts",

26 "publishConfig": {

27 "access": "public"

28 },

29 "files": [

30 "lib/*",

31 "WAProto/*",

32 "engine-requirements.js"

33 ],

34 "scripts": {

35 "build:all": "tsc && typedoc",

36 "build:docs": "typedoc",

37 "build:tsc": "tsc",

38 "changelog:last": "conventional-changelog -p angular -r 2",

39 "changelog:preview": "conventional-changelog -p angular -u",

40 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

41 "example": "node --inspect -r ts-node/register Example/example.ts",

42 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

43 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

44 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

45 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

46 "release": "release-it",

47 "test": "test"

48 },

49 "dependencies": {

50 "@adiwajshing/keyed-db": "^0.2.4",

51 "@cacheable/node-cache": "^1.4.0",

52 "@hapi/boom": "^10.0.1",

53 "async-mutex": "^0.5.0",

54 "axios": "^1.13.2",

55 "chalk": "^4.1.2",

56 "cheerio": "^1.1.2",

57 "jimp": "^0.22.10",

58 "libsignal": "github:realvare/libsignal",

59 "lodash": "^4.17.21",

60 "long": "^5.2.3",

61 "music-metadata": "^11.7.0",

62 "node-cache": "^5.1.2",

63 "pino": "^10.1.0",

64 "protobufjs": "^7.5.4",

65 "protobufjs-cli": "^2.0.0",

lib/WABinary/constants.jsView file

Lines 583-623javascript

583 '044',

584 'mms_cat_v1_forward_hot_override_enabled',

585 'user_notice',

586 'ptt_waveform_send',

587 '047',

588 'Asia/Calcutta',

589

lib/Utils/messages-media.jsView file

Lines 315-355javascript

315};

316exports.mediaMessageSHA256B64 = mediaMessageSHA256B64;

317async function getAudioDuration(buffer) {

318 const musicMetadata = await Promise

lib/Types/Message.jsView file

Lines 1-7javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.WAMessageStatus = exports.WAMessageStubType = exports.WAProto = void 0

lib/Utils/validate-connection.jsView file

Lines 97-137javascript

97 supportHostedGroupMsg: true,

98 supportFbidBotChatHistory: true,

99 supportAddOnHistorySyncMigration: undefined,

100 supportMessageAssociation: true,

101

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 304 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 10023457 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

@chatunity/baileys@3.0.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code