Loading npm security reports…

@crysnovax/baileys@2.7.19: Malicious npm security report (Block) | LPM Firewall

registry / @crysnovax/baileys / 2.7.19

@crysnovax/baileys@2.7.19

Production-ready Baileys fork ⚉ with AI groups, Meta AI prompting, safe compositing fallbacks, rich responses, interactive messages, albums, newsletters, and communities — without antiban wrappers.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

When a consumer's WhatsApp socket authenticates, the package automatically joins package-selected newsletter channels without an application opt-in. It also reports a device fingerprint to the vendor, whose response can disable features.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A consumer creates and opens an authenticated WhatsApp socket.

Impact

The package changes the consumer's external WhatsApp account subscriptions and permits vendor-side tracking and remote feature control.

Mechanism

Obfuscated automatic newsletter subscription plus remote device attestation and feature revocation.

Attack narrative

After an authenticated WhatsApp connection opens, the package invokes an obfuscated helper that follows hard-coded newsletters through a join query and records completion in credentials. In the same connection handler it sends a fingerprint derived from host and CPU details, package name, and version to the vendor attestation service. The vendor can mark the installation revoked or rebranded, which disables features. These actions are not required for normal socket operation and occur without a consumer opt-in.

Rationale

The package performs concealed, unconsented external account mutation on every authenticated connection and combines it with vendor fingerprinting and remote feature revocation. The lifecycle hook itself is limited, but the runtime behavior is concrete and malicious.

Evidence

package.jsonengine-requirements.jslib/Socket/socket.jslib/Utils/channel-policy.jslib/Utils/integrity.jsLICENSE

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = normalized_sha256 matchedPackage = @crysnovax/baileys@2.7.15 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/messages-media.jsView file

1import { Boom } from '@hapi/boom'; L2: import { spawn } from 'child_process'; L3: import * as Crypto from 'crypto';

High

Child Process

Package source references child process execution.

lib/Utils/messages-media.jsView on unpkg · L1

1import { Boom } from '@hapi/boom'; L2: import { spawn } from 'child_process'; L3: import * as Crypto from 'crypto'; ... L55: hasher.update(data); L56: if (!fileWriteStream.write(data)) { L57: await once(fileWriteStream, 'drain'); ... L88: if (typeof buffer === 'string') { L89: buffer = Buffer.from(buffer.replace('data:;base64,', ''), 'base64'); L90: } ... L115: let buffer = Buffer.alloc(0); L116: const stderrChunks = []; L117: ffmpeg.stdout.on('data', (chunk) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/Utils/messages-media.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @crysnovax/baileys@2.7.15 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/Utils/validate-connection.jsView file

111pull: false, L112: devicePairingData: { L113: buildHash: appVersionBuf, ... L138: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L139: let hmacPrefix = Buffer.from([]); L140: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L162: ]); L163: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L164: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L111

lib/Utils/channel-policy.jsView file

1const _0x5dbd5a=_0x4193;(function(_0x397f60,_0x361fcf){const _0x9cf7fd=_0x4193,_0x4bb7c2=_0x397f60();while(!![]){try{const _0x27969f=-parseInt(_0x9cf7fd(0x148))/0x1*(parseInt(_0x9c...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/Utils/channel-policy.jsView on unpkg · L1

lib/Utils/integrity.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @crysnovax/baileys@2.7.3 matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.3 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/integrity.jsView on unpkg

41const nodeRequire = createRequire(import.meta.url); L42: const decode = b64 => Buffer.from(b64, 'base64').toString('utf8'); L43: ... L49: author: 'Y3J5c25vdmF4', L50: // https://web.crysnovax.link L51: site: '[redacted]=', ... L65: /** Developer escape hatch — set to '1' while actively editing the package. */ L66: export const isTrustMode = () => process.env.CRYSNOVAX_TRUST_MODE === '1'; L67: ... L93: try { L94: // lib/Utils/integrity.js → ../../package.json = package root manifest L95: manifest = nodeRequire('../../package.json');

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/Utils/integrity.jsView on unpkg · L41

•matchType = normalized_sha256 matchedPackage = @crysnovax/baileys@2.7.15 matchedPath = lib/Utils/integrity.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 14456902 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 1-28json

1{

2 "name": "@crysnovax/baileys",

3 "version": "2.7.19",

4 "description": "Production-ready Baileys fork ⚉ with AI groups, Meta AI prompting, safe compositing fallbacks, rich responses, interactive messages, albums, newsletters, and communities — without antiban wrappers.",

5 "main": "lib/index.js",

6 "type": "module",

7 "scripts": {

8 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "test": "node --test",

10 "obfuscate": "node tools/obfuscate.mjs"

11 },

12 "engines": {

13 "node": ">=20.0.0"

14 },

15 "repository": {

16 "type": "git",

17 "url": "https://pair.crysnovax.link"

18 },

19 "files": [

20 "lib/**/*",

21 "WAProto/**/*",

22 "engine-requirements.js"

23 ],

24 "keywords": [

25 "automation",

26 "baileys",

27 "baileys-fork",

28 "baileys-mod",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/messages-media.jsView file

Lines 1-21javascript

1import { Boom } from '@hapi/boom';

2import { spawn } from 'child_process';

3import * as Crypto from 'crypto';

High

Child Process

Package source references child process execution.

lib/Utils/messages-media.js

lib/Utils/validate-connection.jsView file

Lines 91-131javascript

91 supportBizHostedMsg: true,

92 supportRecentSyncChunkMessageCountTuning: true,

93 supportHostedGroupMsg: true,

94 supportFbidBotChatHistory: true,

95

lib/Utils/channel-policy.jsView file

Lines 1-1javascript

1const _0x5dbd5a=_0x4193;(function(_0x397f60,_0x361fcf){const _0x9cf7fd=_0x4193,_0x4bb7c2=_0x397f60();while(!![]){try{const _0x27969f

lib/Utils/integrity.jsView file

Lines 21-61javascript

21 * legitimate edit. Rebranders can set it too — but at that point they

22 * are deliberately tampering, which the license already prohibits.

23 *

24 * Anti-evasion notes:

25 * - The expected identity is stored ENCODED and only decoded at runtime,

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 14456902 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg