@dcloude/baileys@0.0.8
Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
WhatsApp Baileys Library Modification to make it easier for developers to develop for anything
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe lifecycle hook only enforces the Node version, and the credential transport and account methods inspected are tied to WhatsApp endpoints and caller-invoked APIs. Scanner signals resolve to protocol token tables, protobuf serialization code, or opt-in functionality; no concrete attack behavior was found.
Decision evidence
public snapshot- The preinstall hook runs a Node version check; it does not install dependencies, modify files, or contact a server.
- Credential-bearing GraphQL requests go to WhatsApp endpoints. WAMO credentials are supplied to the helper, whose default host is wamo.whatsapp.net.
- The WAMO account operations are exposed as socket methods; the inspected code does not call them automatically.
- The command loader is an opt-in API that loads JavaScript modules from the caller-provided directory.
- The flagged constants file contains protocol token tables, and WAProto imports protobuf utilities for generated serialization code.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
Affected versions and remediation
This report applies to @dcloude/baileys@0.0.8.
See all versions of @dcloude/baileys for other recorded verdicts.
- Review the evidence and your use of @dcloude/baileys@0.0.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.