registry / @japofc/baileys / 2.4.4

@japofc/baileys@2.4.4

⚠ Under review

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 272 file(s), 4.23 MB of source, external domains: 127.0.0.1, a2ui.org, api.openai.com, call.whatsapp.com, chat.whatsapp.com, emscripten.org, example.com, fburl.com, mock.local, raw.githubusercontent.com, wa.me, web.whatsapp.com, whatsapp.com, www.internalfb.com, www.w3.org, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js6.24 MB file, sampled 256 KB

No sampled risky behavior triggered.

Source & flagged code

11 flagged

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = normalized_sha256 matchedPackage = @vanzxy/baileys@1.4.6 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:QHZhbnp4eS9iYWlsZXlz:1.4.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/VoIP/worker-bootstrap.jsView file

350const code = fs.readFileSync(url, "utf8"); L351: eval(code); L352: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/VoIP/worker-bootstrap.jsView on unpkg · L350

lib/Utils/auth-db.jsView file

30try { L31: const mod = await import(name); L32: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/auth-db.jsView on unpkg · L30

lib/VoIP/wasm-engine.jsView file

17const __filename = fileURLToPath(import.meta.url); L18: const __dirname = path.dirname(__filename); L19: const CALL_WASM_AB_PROPS_JSON = process.env.CALL_WASM_AB_PROPS_JSON ?? ""; L20: const PTHREAD_POOL_SIZE = 20; ... L25: try { L26: const parsed = JSON.parse(raw); L27: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) ... L51: }; L52: const filterWorkerStderr = (chunk) => { L53: const line = chunk.toString().trim(); L54: if (line && !line.startsWith("voip:") && !line.startsWith("still waiting")) { L55: process.stderr.write(chunk);

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/VoIP/wasm-engine.jsView on unpkg · L17

lib/Utils/crypto.jsView file

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto'; L2: import * as curve from 'libsignal/src/curve.js'; ... L42: return { L43: private: Buffer.from(privKey), L44: // remove version byte

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

lib/assets/wasm/whatsapp.wasmView file

•path = lib/assets/wasm/whatsapp.wasm kind = wasm_module sizeBytes = 11060464 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/assets/wasm/whatsapp.wasmView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 6542325 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

scripts/fetch-wasm-resources.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @japofc/baileys@2.4.0 matchedIdentity = npm:QGphcG9mYy9iYWlsZXlz:2.4.0 similarity = 0.475 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/fetch-wasm-resources.mjsView on unpkg

Source & flagged code

11 flagged · loading source

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/VoIP/worker-bootstrap.js

Findings

5 High7 Medium6 Low

HighHigh Secretlib/WABinary/constants.js

HighSemantic Analysis LimitedWAProto/index.js

HighKnown Malware Source Similaritylib/WABinary/constants.js

HighPrevious Version Dangerous Deltascripts/fetch-wasm-resources.mjs

HighSecret Patternlib/WABinary/constants.js

MediumDynamic Requirelib/Utils/auth-db.js

MediumUnsafe Vm Contextlib/VoIP/wasm-engine.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @japofc/baileys@2.4.4.

See version security history for other recorded verdicts.

Review the evidence and your use of @japofc/baileys@2.4.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 03:01:09.039Z (UTC).