OpenSSF/OSV advisory MAL-2026-17618 confirms this npm version as malicious. The package was found to contain malicious code or consuming dependency that contains malicious code
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Package source references weak cryptographic algorithms.
lib/Utils/validate-connection.jsView on unpkg · L114Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgGoogle API key in lib/WABinary/constants.d.ts
lib/WABinary/constants.d.tsView on unpkg · L20This report applies to @diezyclutch/baileys@8.6.77.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Package source references weak cryptographic algorithms.
lib/Utils/validate-connection.jsView on unpkg · L114Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgGoogle API key in lib/WABinary/constants.d.ts
lib/WABinary/constants.d.tsView on unpkg · L20