registry / @dreamguyxeon/baileyx / 2.0.0

@dreamguyxeon/baileyx@2.0.0

customised baileys by Telegram @dgxeon13

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Creating a newsletter socket schedules hidden account actions. It downloads a remote list and follows each listed WhatsApp newsletter without caller consent.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime call to makeNewsletterSocket, then 120 seconds.

Impact

Unconsented modification of the user's WhatsApp account subscriptions; remote operator can change targets.

Mechanism

remote-controlled automatic WhatsApp newsletter follows

Attack narrative

When the application creates a newsletter socket, the package waits two minutes, downloads channel IDs controlled by the package author, and issues WhatsApp FOLLOW operations for each one. This hidden remote-controlled account mutation is unrelated to the requested socket operation.

Rationale

Source establishes a concrete, remotely controlled and unconsented account-action chain. The lifecycle hook is benign, but it does not mitigate the runtime behavior.

Evidence

lib/Socket/newsletter.jspackage.jsonengine-requirements.jslib/index.jslib/Utils/generics.js

Network endpoints1

raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json

@dreamguyxeon/baileyx@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code