@denzz221/baileys@8.1.6
WhatsApp API Modification By DenixXvynix
AI Security Review
scanned 1h ago · by lpm-firewall-aiThe package automatically follows a publisher-selected WhatsApp newsletter when a client socket is created. This is an unrequested account action, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller constructs the standard WhatsApp socket; the follow is scheduled 90 seconds after newsletter socket construction.
Impact
The user's WhatsApp account is made to follow a channel without an explicit request.
Mechanism
The timer calls the newsletter query with a hard-coded newsletter ID and the FOLLOW query type.
Attack narrative
Building the standard socket constructs the newsletter socket, which schedules a follow request to a hard-coded newsletter after 90 seconds. This uses the user's WhatsApp account for an account action they did not request.
AI rationale
The package automatically follows a publisher-selected WhatsApp newsletter when a client socket is created. This is an unrequested account action, so the package should be blocked.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/index.js
Network endpoints1
WhatsApp server via WABinary_1.S_WHATSAPP_NET
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Creating the newsletter socket schedules a FOLLOW request to the fixed newsletter ID 120363400780200098@newsletter after 90 seconds.
- The normal socket construction path calls the newsletter socket while building the messages socket.
- The preinstall script only checks the Node.js version and exits if it is below 20.
Evidence against
- The flagged media and message utilities handle media URLs and link previews, which fit a WhatsApp client library's purpose.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
GitDependency
Oversized source lightweight scan
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = @denzz221/baileys@8.0.5
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:QGRlbnp6MjIxL2JhaWxleXM:8.0.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
4 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @denzz221/baileys@8.1.6.
See all versions of @denzz221/baileys for other recorded verdicts.
- Avoid installing @denzz221/baileys@8.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.