registry / @haimiya/baileys / 9.4.6

@haimiya/baileys@9.4.6

Full source fork Baileys by HAIMIYA SERVER

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 131 file(s), 1.96 MB of source, external domains: call.whatsapp.com, example.com, mmg.whatsapp.net, quicklatex.com, raw.githubusercontent.com, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js4.23 MB file, sampled 256 KB

ChildProcess

Source & flagged code

9 flagged

package.jsonView file

Lines 3-56json

3 "type": "module",

4 "version": "9.4.6",

5 "description": "Full source fork Baileys by HAIMIYA SERVER",

6 "keywords": [

7 "baileys",

8 "whatsapp",

9 "haimiya",

10 "bot",

11 "whatsapp-web",

12 "automation"

13 ],

14 "license": "MIT",

15 "author": "HAIMIYA",

16 "main": "lib/index.js",

17 "types": "lib/index.d.ts",

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L23

24 "build:all": "npm run build && npm run build:docs",

25 "build:docs": "typedoc",

26 "changelog:last": "conventional-changelog -p angular -r 2",

27 "changelog:preview": "conventional-changelog -p angular -u",

28 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

29 "example": "tsx ./Example/example.ts",

30 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

31 "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",

32 "formattt": "prettier --write .",

33 "formatt": "prettier --write *",

34 "lint": "tsc && eslint src --ext .js,.ts",

35 "lint:fix": "npm run format && npm run lint -- --fix",

36 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 "release": "release-it",

38 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'",

39 "test:e2e": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test-e2e.ts'",

40 "update:version": "tsx ./scripts/update-version.ts"

41 },

42 "dependencies": {

43 "@cacheable/node-cache": "^1.4.0",

44 "@hapi/boom": "^9.1.3",

45 "async-mutex": "^0.5.0",

46 "fflate": "^0.8.2",

47 "libsignal": "https://registry.npmjs.org/@queenanya/libsignal/-/libsignal-5.0.5.tgz",

48 "long": "^5.3.2",

49 "lru-cache": "^11.1.0",

50 "music-metadata": "11.12.1",

51 "p-queue": "^9.0.0",

52 "pino": "^9.6",

53 "protobufjs": "^7.2.4",

54 "qrcode-terminal": "^0.12.0",

55 "whatsapp-rust-bridge": "0.5.3",

56 "ws": "^8.13.0"

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

588 '31',

589 '29',

590 '128',

591 'md_messaging_enabled',

592 '046',

593 'crypto',

594 '690',

595 '045',

596 'enc_iv',

597 '75',

598 'failure',

599 'ptt_oot_playback',

600 'AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

601 'w',

602 '048',

603 '2201',

604 'web_large_files_ui',

605 'Asia/Makassar',

606 '812',

607 'status_collapse_muted',

608 '1334',

609 '257',

610 '2HP4dm',

611 '049',

612 'patches',

613 '1290',

614 '43cY6T',

615 'America/Caracas',

616 'web_sticker_maker',

617 'campaign',

618 'ptt_pausable_enabled',

619 '33',

620 '42',

lib/addons/templates.jsView file

Lines 66-106javascript

66 if (defaultValue !== undefined)

67 return defaultValue;

68 return match;

69 });

70 }

71 render(id, data = {}) {

72 const template = this.templates.get(id);

73 if (!template)

74 throw new Error(`Template not found: ${id}`);

75 return this.renderContent(template.content, data);

76 }

77 validate(id, data) {

78 const template = this.templates.get(id);

79 if (!template)

80 throw new Error(`Template not found: ${id}`);

81 const missing = template.variables.filter(v => v.required && !(v.name in data)).map(v => v.name);

82 return { valid: missing.length === 0, missing };

83 }

84 export() {

85 return JSON.stringify(Array.from(this.templates.values()), null, 2);

86 }

87 import(json, overwrite = false) {

88 const templates = JSON.parse(json);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/addons/templates.jsView on unpkg · L86

89 let imported = 0;

90 for (const t of templates) {

91 if (!overwrite && this.templates.has(t.id))

92 continue;

93 this.templates.set(t.id, { ...t, createdAt: new Date(t.createdAt), updatedAt: new Date(t.updatedAt) });

94 imported++;

95 }

96 return imported;

97 }

98}

99export const PRESET_TEMPLATES = {

100 ORDER_CONFIRMATION: {

101 name: 'Order Confirmation',

102 category: 'order',

103 content: `✅ *Order Confirmed!*\n\nOrder ID: #{{orderId}}\nCustomer: {{customerName}}\nDate: {{orderDate}}\n\n📦 *Items:*\n{{items}}\n\n💰 *Total: {{total}}*\n\nThank you! 🙏`

104 },

105 WELCOME: {

106 name: 'Welcome Message',

lib/Utils/validate-connection.jsView file

Lines 94-134javascript

94 supportBizHostedMsg: true,

95 supportRecentSyncChunkMessageCountTuning: true,

96 supportHostedGroupMsg: true,

97 supportFbidBotChatHistory: true,

98 supportAddOnHistorySyncMigration: undefined,

99 supportMessageAssociation: true,

100 supportGroupHistory: false,

101 onDemandReady: undefined,

102 supportGuestChat: undefined

103 },

104 version: {

105 primary: 10,

106 secondary: 15,

107 tertiary: 7

108 }

109 };

110 const companionProto = proto.DeviceProps.encode(companion).finish();

111 const registerPayload = {

112 ...getClientPayload(config),

113 passive: false,

114 pull: false,

115 devicePairingData: {

116 buildHash: appVersionBuf,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L114

117 deviceProps: companionProto,

118 eRegid: encodeBigEndian(registrationId),

119 eKeytype: KEY_BUNDLE_TYPE,

120 eIdent: signedIdentityKey.public,

121 eSkeyId: encodeBigEndian(signedPreKey.keyId, 3),

122 eSkeyVal: signedPreKey.keyPair.public,

123 eSkeySig: signedPreKey.signature

124 }

125 };

126 return proto.ClientPayload.fromObject(registerPayload);

127};

128export const configureSuccessfulPairing = (stanza, { advSecretKey, signedIdentityKey, signalIdentities }) => {

129 const msgId = stanza.attrs.id;

130 const pairSuccessNode = getBinaryNodeChild(stanza, 'pair-success');

131 const deviceIdentityNode = getBinaryNodeChild(pairSuccessNode, 'device-identity');

132 const platformNode = getBinaryNodeChild(pairSuccessNode, 'platform');

133 const deviceNode = getBinaryNodeChild(pairSuccessNode, 'device');

134 const businessNode = getBinaryNodeChild(pairSuccessNode, 'biz');

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: number;

5 DICTIONARY_2: number;

6 DICTIONARY_3: number;

7 INTEROP_JID: number;

8 FB_JID: number;

9 AD_JID: number;

10 LIST_8: number;

11 LIST_16: number;

12 JID_PAIR: number;

13 HEX_8: number;

14 BINARY_8: number;

15 BINARY_20: number;

16 BINARY_32: number;

17 NIBBLE_8: number;

18 PACKED_MAX: number;

19};

20export declare const DOUBLE_BYTE_TOKENS: readonly [readonly ["read-self", "active", "fbns", "protocol", "reaction", "screen_width", "heartbeat", "deviceid", "2:47DEQpj8", "uploadfieldstat", "voip_settings", "retry", "priority", "longitude", "conflict", "false", "ig_professional", "replaced", "preaccept", "cover_photo", "uncompressed", "encopt", "ppic", "04", "passive", "status-revoke-drop", "keygen", "540", "offer", "rate", "opus", "latitude", "w:gp2", "ver", "4", "business_profile", "medium", "sender", "prev_v_id", "email", "website", "invited", "sign_credential", "05", "transport", "skey", " ...

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

21export declare const SINGLE_BYTE_TOKENS: string[];

22export declare const TOKEN_MAP: {

23 [token: string]: {

24 dict?: number;

25 index: number;

26 };

27};

28//# sourceMappingURL=constants.d.ts.map

Long lines were clipped for display.

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Remote tarball dependency specs: libsignal@https://registry.npmjs.org/@queenanya/libsignal/-/libsignal-5.0.5.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/addons/templates.jsView file

86} L87: import(json, overwrite = false) { L88: const templates = JSON.parse(json);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/addons/templates.jsView on unpkg · L86

lib/Utils/validate-connection.jsView file

114pull: false, L115: devicePairingData: { L116: buildHash: appVersionBuf, ... L141: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L142: let hmacPrefix = Buffer.from([]); L143: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L165: ]); L166: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L167: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L114

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Findings

5 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighOversized Source FileWAProto/index.js

HighSecret Patternlib/WABinary/constants.js

HighSecret Patternlib/WABinary/constants.d.ts

MediumDynamic Requirelib/addons/templates.js

MediumNetwork

MediumShips Build HelperWAProto/GenerateStatics.sh

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 3-56json

3 "type": "module",

4 "version": "9.4.6",

5 "description": "Full source fork Baileys by HAIMIYA SERVER",

6 "keywords": [

7 "baileys",

8 "whatsapp",

9 "haimiya",

10 "bot",

11 "whatsapp-web",

12 "automation"

13 ],

14 "license": "MIT",

15 "author": "HAIMIYA",

16 "main": "lib/index.js",

17 "types": "lib/index.d.ts",

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L23

24 "build:all": "npm run build && npm run build:docs",

25 "build:docs": "typedoc",

26 "changelog:last": "conventional-changelog -p angular -r 2",

27 "changelog:preview": "conventional-changelog -p angular -u",

28 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

29 "example": "tsx ./Example/example.ts",

30 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

31 "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",

32 "formattt": "prettier --write .",

33 "formatt": "prettier --write *",

34 "lint": "tsc && eslint src --ext .js,.ts",

35 "lint:fix": "npm run format && npm run lint -- --fix",

36 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 "release": "release-it",

38 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'",

39 "test:e2e": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test-e2e.ts'",

40 "update:version": "tsx ./scripts/update-version.ts"

41 },

42 "dependencies": {

43 "@cacheable/node-cache": "^1.4.0",

44 "@hapi/boom": "^9.1.3",

45 "async-mutex": "^0.5.0",

46 "fflate": "^0.8.2",

47 "libsignal": "https://registry.npmjs.org/@queenanya/libsignal/-/libsignal-5.0.5.tgz",

48 "long": "^5.3.2",

49 "lru-cache": "^11.1.0",

50 "music-metadata": "11.12.1",

51 "p-queue": "^9.0.0",

52 "pino": "^9.6",

53 "protobufjs": "^7.2.4",

54 "qrcode-terminal": "^0.12.0",

55 "whatsapp-rust-bridge": "0.5.3",

56 "ws": "^8.13.0"

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

588 '31',

589 '29',

590 '128',

591 'md_messaging_enabled',

592 '046',

593 'crypto',

594 '690',

595 '045',

596 'enc_iv',

597 '75',

598 'failure',

599 'ptt_oot_playback',

600 'AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

601 'w',

602 '048',

603 '2201',

604 'web_large_files_ui',

605 'Asia/Makassar',

606 '812',

607 'status_collapse_muted',

608 '1334',

609 '257',

610 '2HP4dm',

611 '049',

612 'patches',

613 '1290',

614 '43cY6T',

615 'America/Caracas',

616 'web_sticker_maker',

617 'campaign',

618 'ptt_pausable_enabled',

619 '33',

620 '42',

lib/addons/templates.jsView file

Lines 66-106javascript

66 if (defaultValue !== undefined)

67 return defaultValue;

68 return match;

69 });

70 }

71 render(id, data = {}) {

72 const template = this.templates.get(id);

73 if (!template)

74 throw new Error(`Template not found: ${id}`);

75 return this.renderContent(template.content, data);

76 }

77 validate(id, data) {

78 const template = this.templates.get(id);

79 if (!template)

80 throw new Error(`Template not found: ${id}`);

81 const missing = template.variables.filter(v => v.required && !(v.name in data)).map(v => v.name);

82 return { valid: missing.length === 0, missing };

83 }

84 export() {

85 return JSON.stringify(Array.from(this.templates.values()), null, 2);

86 }

87 import(json, overwrite = false) {

88 const templates = JSON.parse(json);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/addons/templates.jsView on unpkg · L86

89 let imported = 0;

90 for (const t of templates) {

91 if (!overwrite && this.templates.has(t.id))

92 continue;

93 this.templates.set(t.id, { ...t, createdAt: new Date(t.createdAt), updatedAt: new Date(t.updatedAt) });

94 imported++;

95 }

96 return imported;

97 }

98}

99export const PRESET_TEMPLATES = {

100 ORDER_CONFIRMATION: {

101 name: 'Order Confirmation',

102 category: 'order',

103 content: `✅ *Order Confirmed!*\n\nOrder ID: #{{orderId}}\nCustomer: {{customerName}}\nDate: {{orderDate}}\n\n📦 *Items:*\n{{items}}\n\n💰 *Total: {{total}}*\n\nThank you! 🙏`

104 },

105 WELCOME: {

106 name: 'Welcome Message',

lib/Utils/validate-connection.jsView file

Lines 94-134javascript

94 supportBizHostedMsg: true,

95 supportRecentSyncChunkMessageCountTuning: true,

96 supportHostedGroupMsg: true,

97 supportFbidBotChatHistory: true,

98 supportAddOnHistorySyncMigration: undefined,

99 supportMessageAssociation: true,

100 supportGroupHistory: false,

101 onDemandReady: undefined,

102 supportGuestChat: undefined

103 },

104 version: {

105 primary: 10,

106 secondary: 15,

107 tertiary: 7

108 }

109 };

110 const companionProto = proto.DeviceProps.encode(companion).finish();

111 const registerPayload = {

112 ...getClientPayload(config),

113 passive: false,

114 pull: false,

115 devicePairingData: {

116 buildHash: appVersionBuf,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L114

117 deviceProps: companionProto,

118 eRegid: encodeBigEndian(registrationId),

119 eKeytype: KEY_BUNDLE_TYPE,

120 eIdent: signedIdentityKey.public,

121 eSkeyId: encodeBigEndian(signedPreKey.keyId, 3),

122 eSkeyVal: signedPreKey.keyPair.public,

123 eSkeySig: signedPreKey.signature

124 }

125 };

126 return proto.ClientPayload.fromObject(registerPayload);

127};

128export const configureSuccessfulPairing = (stanza, { advSecretKey, signedIdentityKey, signalIdentities }) => {

129 const msgId = stanza.attrs.id;

130 const pairSuccessNode = getBinaryNodeChild(stanza, 'pair-success');

131 const deviceIdentityNode = getBinaryNodeChild(pairSuccessNode, 'device-identity');

132 const platformNode = getBinaryNodeChild(pairSuccessNode, 'platform');

133 const deviceNode = getBinaryNodeChild(pairSuccessNode, 'device');

134 const businessNode = getBinaryNodeChild(pairSuccessNode, 'biz');

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: number;

5 DICTIONARY_2: number;

6 DICTIONARY_3: number;

7 INTEROP_JID: number;

8 FB_JID: number;

9 AD_JID: number;

10 LIST_8: number;

11 LIST_16: number;

12 JID_PAIR: number;

13 HEX_8: number;

14 BINARY_8: number;

15 BINARY_20: number;

16 BINARY_32: number;

17 NIBBLE_8: number;

18 PACKED_MAX: number;

19};

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

21export declare const SINGLE_BYTE_TOKENS: string[];

22export declare const TOKEN_MAP: {

23 [token: string]: {

24 dict?: number;

25 index: number;

26 };

27};

28//# sourceMappingURL=constants.d.ts.map

Long lines were clipped for display.