registry / @crysnovax/baileys / 2.7.15

@crysnovax/baileys@2.7.15

Production-ready Baileys fork ⚉ with AI groups, Meta AI prompting, safe compositing fallbacks, rich responses, interactive messages, albums, newsletters, and communities — without antiban wrappers.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening an authenticated WhatsApp socket silently follows package-selected newsletters. It also sends a host-derived fingerprint to a vendor verification endpoint.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User application opens a WhatsApp socket through the package.

Impact

Changes the user's WhatsApp newsletter subscriptions without consent and discloses a stable host-derived fingerprint.

Mechanism

automatic authenticated newsletter follow and runtime fingerprint attestation

Attack narrative

On every authenticated connection, the socket handler calls an obfuscated trusted-channel routine and supplies a WhatsApp MEX FOLLOW request for package-selected newsletter IDs. This occurs without an application option or user action. Separately, the runtime integrity component hashes hostname, OS, architecture, CPU model, and Node version, then posts the fingerprint and package identity to the vendor verification service.

Rationale

The package performs an undisclosed, automatic action on the user's authenticated WhatsApp account, concealed in an obfuscated policy module. Its install hook is not the attack vector, but the runtime subscription mutation is concrete malicious behavior.

Evidence

lib/Socket/socket.jslib/Utils/channel-policy.jslib/Utils/integrity.jsengine-requirements.jspackage.json

Network endpoints2

bailey.crysnovax.link/api/v1/verifywss://web.whatsapp.com/ws/chat

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Authenticated socket opening automatically invokes a newsletter FOLLOW operation.
The forced-channel policy is deliberately obfuscated and embeds a newsletter JID.
Runtime attestation fingerprints host/device details and POSTs them to the vendor endpoint.

Evidence against

The preinstall hook only checks Node version and reads this package's manifest.
No credential-file harvesting or shell payload execution was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 136 file(s), 2.22 MB of source, external domains: acs.whatsapp.com, call.whatsapp.com, github.com, graph.whatsapp.com, stackoverflow.com, v.whatsapp.net, web.crysnovax.link, web.whatsapp.com, www.facebook.com, www.npmjs.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js13.8 MB file, sampled 256 KB

ChildProcess

Source & flagged code

14 flagged

package.jsonView file

Lines 1-28json

2 "name": "@crysnovax/baileys",

3 "version": "2.7.15",

4 "description": "Production-ready Baileys fork ⚉ with AI groups, Meta AI prompting, safe compositing fallbacks, rich responses, interactive messages, albums, newsletters, and communities — without antiban wrappers.",

5 "main": "lib/index.js",

6 "type": "module",

7 "scripts": {

8 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "test": "node --test",

10 "obfuscate": "node tools/obfuscate.mjs"

11 },

12 "engines": {

13 "node": ">=20.0.0"

14 },

15 "repository": {

16 "type": "git",

17 "url": "https://pair.crysnovax.link"

18 },

19 "files": [

20 "lib/**/*",

21 "WAProto/**/*",

22 "engine-requirements.js"

23 ],

24 "keywords": [

25 "automation",

26 "baileys",

27 "baileys-fork",

28 "baileys-mod",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/messages-media.jsView file

Lines 1-21javascript

1import { Boom } from '@hapi/boom';

2import { spawn } from 'child_process';

3import * as Crypto from 'crypto';

High

Child Process

Package source references child process execution.

lib/Utils/messages-media.js

lib/Utils/validate-connection.jsView file

Lines 91-131javascript

91 supportBizHostedMsg: true,

92 supportRecentSyncChunkMessageCountTuning: true,

93 supportHostedGroupMsg: true,

94 supportFbidBotChatHistory: true,

lib/Utils/channel-policy.jsView file

Lines 1-1javascript

1const _0x5dbd5a=_0x4193;(function(_0x397f60,_0x361fcf){const _0x9cf7fd=_0x4193,_0x4bb7c2=_0x397f60();while(!![]){try{const _0x27969f

lib/Utils/integrity.jsView file

Lines 21-61javascript

21 * legitimate edit. Rebranders can set it too — but at that point they

22 * are deliberately tampering, which the license already prohibits.

23 *

24 * Anti-evasion notes:

25 * - The expected identity is stored ENCODED and only decoded at runtime,

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 14456902 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = normalized_sha256 matchedPackage = @crysnovax/baileys@2.7.13 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/messages-media.jsView file

1import { Boom } from '@hapi/boom'; L2: import { spawn } from 'child_process'; L3: import * as Crypto from 'crypto';

High

Child Process

Package source references child process execution.

lib/Utils/messages-media.jsView on unpkg · L1

1import { Boom } from '@hapi/boom'; L2: import { spawn } from 'child_process'; L3: import * as Crypto from 'crypto'; ... L55: hasher.update(data); L56: if (!fileWriteStream.write(data)) { L57: await once(fileWriteStream, 'drain'); ... L88: if (typeof buffer === 'string') { L89: buffer = Buffer.from(buffer.replace('data:;base64,', ''), 'base64'); L90: } ... L115: let buffer = Buffer.alloc(0); L116: const stderrChunks = []; L117: ffmpeg.stdout.on('data', (chunk) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/Utils/messages-media.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @crysnovax/baileys@2.7.13 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/Utils/validate-connection.jsView file

111pull: false, L112: devicePairingData: { L113: buildHash: appVersionBuf, ... L138: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L139: let hmacPrefix = Buffer.from([]); L140: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L162: ]); L163: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L164: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L111

lib/Utils/channel-policy.jsView file

1const _0x5dbd5a=_0x4193;(function(_0x397f60,_0x361fcf){const _0x9cf7fd=_0x4193,_0x4bb7c2=_0x397f60();while(!![]){try{const _0x27969f=-parseInt(_0x9cf7fd(0x148))/0x1*(parseInt(_0x9c...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/Utils/channel-policy.jsView on unpkg · L1

lib/Utils/integrity.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @crysnovax/baileys@2.7.3 matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.3 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/integrity.jsView on unpkg

41const nodeRequire = createRequire(import.meta.url); L42: const decode = b64 => Buffer.from(b64, 'base64').toString('utf8'); L43: ... L49: author: 'Y3J5c25vdmF4', L50: // https://web.crysnovax.link L51: site: '[redacted]=', ... L65: /** Developer escape hatch — set to '1' while actively editing the package. */ L66: export const isTrustMode = () => process.env.CRYSNOVAX_TRUST_MODE === '1'; L67: ... L93: try { L94: // lib/Utils/integrity.js → ../../package.json = package root manifest L95: manifest = nodeRequire('../../package.json');

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/Utils/integrity.jsView on unpkg · L41

•matchType = normalized_sha256 matchedPackage = @crysnovax/baileys@2.7.13 matchedPath = lib/Utils/integrity.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/integrity.jsView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 14456902 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Findings

1 Critical13 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltalib/Utils/integrity.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighChild Processlib/Utils/messages-media.js

HighShell

HighCommand Output Exfiltrationlib/Utils/messages-media.js

HighObfuscated Payload Loaderlib/Utils/channel-policy.js

HighBase64 Obscured Urllib/Utils/integrity.js

HighObfuscated

HighSemantic Analysis Limitedlib/Utils/business.js

HighKnown Malware Source Similaritylib/Utils/integrity.js

HighKnown Malware Source Similaritylib/Utils/messages-media.js

HighKnown Malware Source Similaritylib/WABinary/constants.js

HighSecret Patternlib/WABinary/constants.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License