@ikyzanx/baileys@8.5.6
A WebSockets library for interacting with WhatsApp Web — iky fork of Baileys
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe default socket factory reaches a timer that follows a publisher-selected WhatsApp newsletter through the user’s account without consent. This is an unauthorized account action and warrants blocking the package version.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Default makeWASocket construction reaches the newsletter socket layer; a timer then runs the follow request.
Impact
The user’s WhatsApp account follows a publisher-selected newsletter without consent.
Mechanism
The code decodes a hard-coded newsletter identifier and sends a FOLLOW mutation without an explicit user request.
Attack narrative
When the default socket is constructed, its factory chain reaches code that schedules a FOLLOW request for a hard-coded newsletter labeled “About Iky”; the request uses the user’s WhatsApp account without an explicit request to follow it.
AI rationale
The default socket factory reaches a timer that follows a publisher-selected WhatsApp newsletter through the user’s account without consent. This is an unauthorized account action and warrants blocking the package version.
Evidence
lib/Socket/index.jslib/Socket/communities.jslib/Socket/business.jslib/Socket/messages-recv.jslib/Socket/messages-send.jslib/Socket/username.jslib/Socket/newsletter.js
Network endpoints1
S_WHATSAPP_NET ('@s.whatsapp.net'), via a w:mex IQ
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default socket factory’s construction chain reaches makeNewsletterSocket.
- That constructor schedules a newsletter FOLLOW query for a base64-encoded target commented as “About Iky”.
- The FOLLOW query is sent as a w:mex IQ to S_WHATSAPP_NET.
Evidence against
- The preinstall hook only checks the Node.js version and exits on unsupported versions.
- The package describes itself as a WhatsApp Web library, so its normal WhatsApp network traffic is expected.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
GitDependency
Oversized source lightweight scan
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @ikyzanx/baileys@8.5.6.
See all versions of @ikyzanx/baileys for other recorded verdicts.
- Avoid installing @ikyzanx/baileys@8.5.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.