@ikyyjeee/xavoidbail@0.0.5
WhatsApp Baileys Library Modification to make it easier for developers to develop for anything
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe preinstall hook only enforces the Node.js version, and inspected GraphQL credential transport is directed to WhatsApp or Facebook services with caller-supplied WAMO configuration. The flagged dynamic loading, network calls, and large protocol files are consistent with the package’s WhatsApp library behavior.
Decision evidence
public snapshot- The preinstall hook only checks the Node.js version; prepare and prepack are empty.
- GraphQL requests target WhatsApp and Facebook services; WAMO defaults to wamo.whatsapp.net, and its credentials and optional host are supplied through the socket API.
- Account operations are exposed as caller-invoked socket methods; source review found no automatic account-action caller.
- The command loader dispatches registered commands from prefixed incoming messages.
- WAProto contains generated protocol definitions, and WABinary/constants.js contains protocol token data.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
Affected versions and remediation
This report applies to @ikyyjeee/xavoidbail@0.0.5.
See all versions of @ikyyjeee/xavoidbail for other recorded verdicts.
- Review the evidence and your use of @ikyyjeee/xavoidbail@0.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.